Set the scope for a token basedon what the user has access to

src/users.js

@@ -320,6 +320,7 @@ function getUser(userId, callback) {
 
             result.groupIds = groupIds;
             result.admin = groupIds.indexOf(constants.ADMIN_GROUP_ID) !== -1;
+            result.scope = result.admin ? '*' : 'profile';
 
             return callback(null, result);
         });