According to the OAuth RFC, the Authorization Code grant can be requested without explicitly providing a list of scopes. This change enables that behavior by using the default scopes the OAuth request was initially populated with.

Fix "Scopes must be set on post auth." exception

Use the locally defined scopes variable rather than trying to pull from the request object, which may not exist in certain requests.

Check to make sure scopes is defined locally or request exists in kwargs and has a scopes attribute. If not, fall back to the old behavior of not declaring default scopes and hope they are not needed.

Remove unused line that wasn't being covered by tests.