How to restrict scopes requested by a third-party application