Optionally include offline_access scope

[nbarbettini]

Clients that are expecting to get a refresh token from /oauth/token will no longer get one unless they request scope offline_access.

A configuration option in express-stormpath to automatically attach that scope to requests would be helpful, because older clients can't always be updated.

[passatgt]

Yes. For now, i forked the repo and added it myself: https://github.com/passatgt/express-stormpath/commit/1bfa3e4c80c69af9016b995c54ad53d93cf01492#diff-e42c26eb9b776c9528853e7075a82b48