If an empty scope is somehow passed along, it shouldn't be validated when checking refresh token scope.
