the server will also send scope and expiration information