Pass user into Client.validate_scopes()

[aparamon]

This extends Client.validate_scopes() to additionally take request argument (and, essentially, request.user) so both scopes and user are available in validation/authorization logic.

[lepture]

The problem is that it is not compatible with old API.

[aparamon]

@lepture Thanks for the review! What if introduce something like
Client.validate_request_scopes(self, request, scopes, *args, **kwargs)
taking precedence over validate_scopes if present?