- Update default Oauth applications scope to read_user from api
  so that its less permissive if default scope has not been provided
- Update OAuth Applications controllers to disallow empty scopes
  application creation