Allow parameters (such as `scope`) to be passed with a token request.

[dbrnz]

Query parameters must be signed -- they cannot simply be appended to the request token URL when it is set.