Modify scopes within an action

Hey @rueben.tiow,

This is all well for post-login, but this does not work for machine-to-machine actions.

To replace hooks we need this functionality on m2m tokens as well.