Fixes the Required scopes in the Web API as

it can be different if you went throught the readme.md
or the app creation script.

Proposing to accept both

Author: jmprieur

1. Desktop app calls Web API/TodoListService/Controllers/TodoListController.cs

@@ -40,9 +40,10 @@ public class TodoListController : Controller
 
         /// <summary>
         /// The Web API will only accept tokens 1) for users, 2) having the user_impersonation scope for
-        /// this API
+        /// this API (if you created the app using the App creation script) or 'access_as_user' if you created
+        /// it following the README.md.
         /// </summary>
-        const string scopeRequiredByAPI = "user_impersonation";
+        static string[] scopeRequiredByAPI = new string[] { "user_impersonation", "access_as_user" };
 
         // GET: api/values
         [HttpGet]

2. Web API now calls Microsoft Graph/TodoListService/Controllers/TodoListController.cs

@@ -57,9 +57,10 @@ public TodoListController(ITokenAcquisition tokenAcquisition)
 
         /// <summary>
         /// The Web API will only accept tokens 1) for users, 2) having the user_impersonation scope for
-        /// this API
+        /// this API (if you created the app using the App creation script) or 'access_as_user' if you created
+        /// it following the README.md.
         /// </summary>
-        const string scopeRequiredByAPI = "user_impersonation";
+        static string[] scopeRequiredByAPI = new string[] { "user_impersonation", "access_as_user" };
 
         // GET: api/values
         [HttpGet]

3.-Web-api-call-Microsoft-graph-for-personal-accounts/TodoListService/Controllers/TodoListController.cs

@@ -57,9 +57,10 @@ public TodoListController(ITokenAcquisition tokenAcquisition)
 
         /// <summary>
         /// The Web API will only accept tokens 1) for users, 2) having the user_impersonation scope for
-        /// this API
+        /// this API (if you created the app using the App creation script) or 'access_as_user' if you created
+        /// it following the README.md.
         /// </summary>
-        const string scopeRequiredByAPI = "user_impersonation";
+        static string[] scopeRequiredByAPI = new string[] { "user_impersonation", "access_as_user" };
 
         // GET: api/values
         [HttpGet]