If it is null, the browser will actually determine what it should be.. We don't have to be smart about it server-side, like I implemented in master..
We could however be smart and derive the scope as I suggested and then compare it to the configured scope (if configured), just so we can warn the IdP-admin about misconfiguration.
To summarize the discussion we had at NTW19:
master
..