The C2S routes and the outbox/followers/following/replies collections accepted a token with any scope. Requests with an OAuth token now need the matching scope; HTTP signatures and Basic auth are not changed.
