Check token aurs instead of asking for apps scope

[cavis]

Account applications (and the scope=apps) are being deprecated.

Instead, check if the actual JWT aur is empty. If it is, you don't have permission to use the app.