fix: use the same scopes for auth session as other extensions

fix: use the same scopes for auth session as other extensions #1028