Enforce scopes when running in secure mode with oauth

[james-peltzer]

Currently not stripping-out parameters of checking for a param scope up the hierarchy (only directly) but it is a starting point.