diff --git a/oatmeal.php b/oatmeal.php
index 6713a12..dfdd093 100644
--- a/oatmeal.php
+++ b/oatmeal.php
@@ -1,9 +1,6 @@
 <?php
 namespace Oatmeal;
 
-use Index\Environment;
-use Index\Data\DbTools;
-
 define('OAT_STARTUP', microtime(true));
 define('OAT_ROOT', __DIR__);
 define('OAT_DEBUG', is_file(OAT_ROOT . '/.debug'));
@@ -12,9 +9,9 @@ define('OAT_DIR_SOURCE', OAT_ROOT . '/src');
 
 require_once OAT_ROOT . '/vendor/autoload.php';
 
-Environment::setDebug(OAT_DEBUG);
-mb_internal_encoding('utf-8');
-date_default_timezone_set('utc');
+error_reporting(OAT_DEBUG ? -1 : 0);
+mb_internal_encoding('UTF-8');
+date_default_timezone_set('GMT');
 
 $oatmeal = new OatmealContext((function() {
     $path = OAT_ROOT . '/.rng';
diff --git a/src/AuthzCodeRoutes.php b/src/AuthzCodeRoutes.php
index 9625bcd..3df6f14 100644
--- a/src/AuthzCodeRoutes.php
+++ b/src/AuthzCodeRoutes.php
@@ -1,10 +1,8 @@
 <?php
 namespace Oatmeal;
 
-use Index\XString;
+use Index\{CSRFP,UriBase64,XString};
 use Index\Http\Routing\{HttpGet,HttpPost,RouteHandler};
-use Index\Security\CSRFP;
-use Index\Serialisation\UriBase64;
 
 final class AuthzCodeRoutes extends RouteHandler {
     public function __construct(
@@ -58,7 +56,7 @@ final class AuthzCodeRoutes extends RouteHandler {
     <div>
         <label>
             <span>Scope:</span>
-            <input type=text name=scope required>
+            <input type=text name=scope>
         </label>
     </div>
     <div>
@@ -146,9 +144,10 @@ HTML;
         $query = [
             'response_type' => 'code',
             'client_id' => $clientId,
-            'scope' => $scope,
         ];
 
+        if($scope !== '')
+            $query['scope'] = $scope;
         if($redirectUri !== '')
             $query['redirect_uri'] = $redirectUri;
         if($state !== '')
diff --git a/src/ClientCredsRoutes.php b/src/ClientCredsRoutes.php
index aa8ffc8..33322be 100644
--- a/src/ClientCredsRoutes.php
+++ b/src/ClientCredsRoutes.php
@@ -1,8 +1,8 @@
 <?php
 namespace Oatmeal;
 
+use Index\CSRFP;
 use Index\Http\Routing\{HttpGet,HttpPost,RouteHandler};
-use Index\Security\CSRFP;
 
 final class ClientCredsRoutes extends RouteHandler {
     public function __construct(
diff --git a/src/DeviceCodeRoutes.php b/src/DeviceCodeRoutes.php
index f679e54..1ed2270 100644
--- a/src/DeviceCodeRoutes.php
+++ b/src/DeviceCodeRoutes.php
@@ -1,8 +1,8 @@
 <?php
 namespace Oatmeal;
 
+use Index\CSRFP;
 use Index\Http\Routing\{HttpGet,HttpPost,RouteHandler};
-use Index\Security\CSRFP;
 
 final class DeviceCodeRoutes extends RouteHandler {
     public function __construct(
@@ -53,7 +53,7 @@ final class DeviceCodeRoutes extends RouteHandler {
     <div>
         <label>
             <span>Scope:</span>
-            <input type=text name=scope required>
+            <input type=text name=scope>
         </label>
     </div>
     <div>
@@ -93,7 +93,10 @@ HTML;
         $scope = (string)$content->getParam('scope');
 
         $headers = [];
-        $body = ['scope' => $scope];
+        $body = [];
+
+        if($scope !== '')
+            $body['scope'] = $scope;
 
         if($clientSecret === '')
             $body['client_id'] = $clientId;
diff --git a/src/OatmealContext.php b/src/OatmealContext.php
index 8a6dc60..bcf03cf 100644
--- a/src/OatmealContext.php
+++ b/src/OatmealContext.php
@@ -1,8 +1,8 @@
 <?php
 namespace Oatmeal;
 
+use Index\CSRFP;
 use Index\Http\Routing\{HttpRouter,IRouter,IRouteHandler};
-use Index\Security\CSRFP;
 
 class OatmealContext {
     private CSRFP $csrfp;
diff --git a/src/RefreshTokenRoutes.php b/src/RefreshTokenRoutes.php
index 52597ff..7daf98e 100644
--- a/src/RefreshTokenRoutes.php
+++ b/src/RefreshTokenRoutes.php
@@ -1,8 +1,8 @@
 <?php
 namespace Oatmeal;
 
+use Index\CSRFP;
 use Index\Http\Routing\{HttpGet,HttpPost,RouteHandler};
-use Index\Security\CSRFP;
 
 final class RefreshTokenRoutes extends RouteHandler {
     public function __construct(
@@ -50,6 +50,12 @@ final class RefreshTokenRoutes extends RouteHandler {
             <input type=password name=client_secret>
         </label>
     </div>
+    <div>
+        <label>
+            <span>Scope:</span>
+            <input type=text name=scope>
+        </label>
+    </div>
     <div>
         <span>Authentication:</span>
         <label>
@@ -101,6 +107,7 @@ HTML;
         $clientSecret = (string)$content->getParam('client_secret');
         $refreshToken = (string)$content->getParam('refresh_token');
         $auth = (string)$content->getParam('auth');
+        $scope = (string)$content->getParam('scope');
 
         $headers = [];
         $body = [
@@ -108,6 +115,9 @@ HTML;
             'refresh_token' => $refreshToken,
         ];
 
+        if($scope !== '')
+            $body['scope'] = $scope;
+
         if($clientSecret === '')
             $body['client_id'] = $clientId;
         elseif($auth === 'body' || ($auth !== 'header' && mt_rand(0, 10) > 5)) {