use scope

[wraithgar]

Returning scope instead of userGroups would be more consistent w/ how hapi does things and allow for routes to continue using scope filtering.