Fix app scopes not being validated
policy
POST /api/v1/push/subscriptions
GET /api/v1/timelines/direct