Store Blender ID OAuth scopes in MongoDB + request badge scope too

This also changes the way we treat Blender ID tokens. Before, the Blender ID
token was discarded and a random token was generated & stored. Now the
actual Blender ID token is stored.

The Facebook and Google OAuth code still uses the old approach of generating
a new token. Not sure what the added value is, though, because once the
Django session is gone there is nothing left to authenticate the user and
thus the random token is useless anyway.

tests/test_api/test_oauth.py

@@ -62,6 +62,8 @@ class OAuthTests(AbstractPillarTest):
             cb = oauth_provider.callback()
             self.assertEqual(cb.id, '7')
             self.assertEqual(cb.email, 'harry@blender.org')
+            self.assertEqual(cb.access_token, 'successful-token')
+            self.assertEqual(cb.scopes, ['email', 'badge'])
 
     @responses.activate
     def test_provider_callback_missing_code(self):