title: Authorization scope issues despite passing "scope" parameter
body: <p>I am experiencing issues requesting "upload" authorization from Vimeo users OTHER than the user that created/registered the app.</p>
  
  <p><strong>Example:</strong><br>
  User-A creates/register's new App-A via the Vimeo developer console.  User-B is asked to authorize App-A to upload on their behalf.  User-B is redirected to Vimeo authorization UI and sees the following:</p>
  
  <p><strong>This app will enable you to:</strong><br>
  Access all of your videos<br>
  <strong>This app will not allow you to:</strong><br>
  Like videos<br>
  Update your video info<br>
  Upload videos to your account<br>
  Delete your videos  </p>
  
  <p>Despite specifying scope in the authentication request URL:</p>
  
  <p><a href="https://vimeo.com/oauth/authorize?client_id=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&amp;locale=en_US&amp;oauth_token=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&amp;redirect_uri=https%3A%2F%2Fxxxxxxxxxxx.xxxxx.com%2Fapi%2Fauth%2Fvimeo%2Fverify&amp;response_type=code&amp;scope=upload&amp;state=" rel="nofollow">https://vimeo.com/oauth/authorize?client_id=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&amp;locale=en_US&amp;oauth_token=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&amp;redirect_uri=https%3A%2F%2Fxxxxxxxxxxx.xxxxx.com%2Fapi%2Fauth%2Fvimeo%2Fverify&amp;response_type=code&amp;scope=upload&amp;state=</a>{%22sessionId%22%3A%2243a9a9d1a7bd44d5a27d0f91b6185875%22}</p>
  
  <p><strong>BUT...</strong></p>
  
  <p>If I send the same request, but login as User-A instead then:</p>
  
  <p><strong>This app will enable you to:</strong><br>
  Access all of your videos<br>
  Upload videos to your account<br>
  <strong>This app will not allow you to:</strong><br>
  Like videos<br>
  Update your video info<br>
  Delete your videos  </p>
  
  <p>Am I missing something obvious?</p>