Returns null, not an empty string, if no requested scope is supported, so callers can reject the request.
null