Neither oauth2:issue_code_grant/3 nor /4 verify the scope

[IvanMartinez]

Neither issue_code_grant/3 nor the /4 version verify the scope. Accordingly to points 4.1.1 and 4.1.3 of the specification, a scope parameter is passed in the authorization request, and a invalid_scope error could be returned. These functions should verify the scope the same way authorize_client_credentials/3 and authorize_password/3 do.

[IvanMartinez]

This is one of the issues that #23 attempts to fix.