fix: allow client scopes when no scope restriction is set

fix: allow client scopes when no scope restriction is set #1162