to ease migration from JWT, we could have a guide describing scopes similar to JWT in biscuit, using `check all` for delegation