Don't rely on token for scopes collection actions (#210)

Don't rely on token for scopes collection actions

This requires `scope_id` to be passed (via query param) for actions on
the scopes collection; that is, listing or creating. However, it removes
the dependency on using the token for the scope of the command. For
actions on a specific scope, we use the given ID to determine the scope
we should be operating at, doing a lookup if necessary.

Existing tests have been updated. Of particular note, the CORS test was
already operating on the scopes collection so served as a good test to
ensure that from an API level the scope_id parameter was being parsed
and passed through (the tests fail without adding that query parameter
in).

internal/servers/controller/handler.go

@@ -125,7 +125,7 @@ func wrapHandlerWithCommonFuncs(h http.Handler, c *Controller, props HandlerProp
 
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if logUrls {
-			c.logger.Trace("request received", "url", r.URL.String())
+			c.logger.Trace("request received", "url", r.URL.RequestURI())
 		}
 
 		// Set the Cache-Control header for all responses returned