title: How to deal with ROLES and FOSOAuthServerBundle scopes
body: <p>I have a basic api that authenticates users using FOSOAuthServerBundle. Users can have ROLE_USER and ROLE_ADMIN roles. Based on FOSOAuthServerBundle docs, the default behavior is to use scopes as roles, so I've thought that when I have a regular user, the bundle would return <code>scope: user</code>in the response, and when it's a admin user, would return <code>scope: admin</code>. But it's not working like this. The bundle is returning whatever is configured in the <code>supported_scopes</code>entry. Below is my <code>config.yml</code>.</p>
  
  <pre><code>fos_oauth_server:
      service:
          options:
              supported_scopes: user admin
  </code></pre>
  
  <p>My <code>access_control</code> section in <code>security.yml</code> is empty, and my <code>firewalls</code> section is below:</p>
  
  <pre><code>firewalls:
          users_create:
              pattern: ^/v1/users
              methods: [POST]
              security: false
  
          api:
              pattern:    ^/
              security: true
              fos_oauth:  true
              stateless:  true
  
  access_control:
          # You can omit this if /api can be accessed both authenticated and anonymously
  </code></pre>
  
  <p>This way the bundle always return <code>user admin</code> as scope, even if the user does not have the ROLE_ADMIN role.</p>
  
  <pre><code>{
  "access_token": "ZGQ2ODE5ZjAzNTZkOWY0OWMyNmZmODE4MjcwZTJmYjExNzY0NzQxOTRmMzk4NzA2Mjc2NjIyZmY1ZDgwMzk4NA"
  "expires_in": 3600
  "token_type": "bearer"
  "scope": "user admin"
  "refresh_token": "NmM5ZGFmNzBiNTNjYmQzMTQ1MTk0ODJjOTAxMWU0YWIwMzM1MzgyODg4ZTAzNTI5ZTk2MDc3OGU2MTg0MWZiMA"
  }
  </code></pre>
  
  <p>What I'm I missing? Isn't the user role attached to token scope? Is there any better way to know if my user is an admin or not? </p>