v4.0.3

• fixed token endpoint grant_type=refresh_token scope parameter related bugs
  • a rotated refresh token will retain the original scope, its only the access and id token that
    has the requested scope as specified in section 6 of RFC6749
  • openid scope must be provided in the list of requested scopes