Microgateway oauth plugin does not seem to enforce scopes

I am working on a system where we are using scopes to enforce RBAC.

The edgemicro-auth proxy was not populating the scopes element on the token. I have tweaked it and now it does. And as expected if the scopes passed in do not mach any of the scopes assigned to the products in the app the scopes element is blank.

But when I use the token to access token to access a microgateway aware proxy the token is accepted whether or not it has scopes, and whether the scope is the correct scope or not.