title: Doorkeeper - Reject access token request if user not an admin
body: <p>Using password-grant OAuth-2 flow, If a non-admin user requests an access token with <code>scope: 'admin'</code> I want to be able to reject that from happening - I'm using doorkeeper with devise. </p>
  
  <p>Currently any old user can ask for any scope and by default it gets granted.</p>
  
  <p>I don't see an obvious hook in doorkeeper to perform this sort of logic. Where/how should I configure this?</p>