fix: better scope handling

TODO.md

@@ -2,12 +2,29 @@
 
 - [x] Login form
 - [x] Register form
-- [x] Generate JWT
-- [ ] Redirect to login form if unauthenticated
-- [x] Authorize form
-- [x] Verify authorize
+- [x] Redirect to login form if unauthenticated
 - [x] Upload picture
-- [x] Get access token
+
+- OAuth2
+    - [x] Authorize form
+    - [x] Verify authorize
+    - [x] Get access token
+
+- [x] Support OpenID to use with demo client [oauth2c](https://github.com/cloudentity/oauth2c)
+    - .well-known/openid-configuration
+
+
+- [ ] i18n strings in the http website.
+
+- [ ] App config
+    - Add app logo (URI?)
+
+- [ ] Public endpoint to get user avatar by id
+- [ ] Rework avatar upload to limit size and process the image?
+
+- [ ] Authorize form
+    - Show details about permissions
+    - Show app logo
 
 - [ ] Support error responses by https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2.1
 
@@ -15,6 +32,3 @@
 - [ ] Add admin panel via API
 - [ ] Add admin CLI
 
-- [ ] Support OpenID to use with demo client [oauth2c](https://github.com/cloudentity/oauth2c)
-
-    - .well-known/openid-configuration