How to use custom OAuth scopes in a third-party application with FusionAuth