Modify scopes within an action

This is only for post-login action. All other action types have no way of updating scopes or permissions on an access token.