Fix the list of scopes in the authorization page
A dynamically registered client only gets the `openid` scope. Yet oxAuth is prompting for release of scopes like `profile` and `email` based on client request.   Although data is not being leaked, it oxAuth is presenting the wrong authorization message to the user.

We should also add a _**negative test**_ to reflect the above case.


diff --git a/Server/src/main/java/org/xdi/oxauth/model/authorize/ScopeChecker.java b/Server/src/main/java/org/xdi/oxauth/model/authorize/ScopeChecker.java
index 8e847f619..b504f159b 100644
--- a/Server/src/main/java/org/xdi/oxauth/model/authorize/ScopeChecker.java
+++ b/Server/src/main/java/org/xdi/oxauth/model/authorize/ScopeChecker.java
@@ -6,24 +6,24 @@
 
 package org.xdi.oxauth.model.authorize;
 
-import java.util.HashSet;
-import java.util.Set;
-
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
-
 import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
 import org.xdi.oxauth.model.registration.Client;
 import org.xdi.oxauth.service.ScopeService;
 
+import javax.ejb.Stateless;
+import javax.inject.Inject;
+import javax.inject.Named;
+import java.util.HashSet;
+import java.util.Set;
+
 /**
  * Validates the scopes received for the authorize web service.
  *
  * @author Yuriy Zabrovarnyy
  * @author Yuriy Movchan
- * @version June 3, 2015
+ * @author Javier Rojas Blum
+ * @version January 30, 2018
  */
 @Stateless
 @Named("scopeChecker")
@@ -39,6 +39,10 @@ public class ScopeChecker {
         log.debug("Checking scopes policy for: " + scope);
         Set<String> grantedScopes = new HashSet<String>();
 
+        if (scope == null || client == null) {
+            return grantedScopes;
+        }
+
         final String[] scopesRequested = scope.split(" ");
         final String[] scopesAllowed = client.getScopes();
 
['Server/src/main/java/org/xdi/oxauth/model/authorize/ScopeChecker.java']