requesting nonce by scopes

[peppelinux]

Mike Jones suggests to request nonces by expliciting their scopes, since each nonce should be intended for a particular endpoint/scope.

If no scopes are requested, a default scope would be configured.

this means that if the nonce carries an encrypted payload, the its scope should be included in the payload.

[peppelinux]

This could be managed by specifying the audience/endpoint, which would implicitly define a sort of scope of the nonce (authorization endpoint ...).

I would give to the nonce the granularity of the oauth scopes

[OR13]

The current examples include audience.

We should update them to include scope as well.

We might also leave room for alternatives to scope to be used in the future.