The validator function get_authorization_code_scopes is called before validate_code, and it is not logical. Why? - I'm using OIDC - I'm writing server side