fix: don't expose scope for non-admin users

http/users.go

@@ -94,6 +94,9 @@ var userGetHandler = withSelfOrAdmin(func(w http.ResponseWriter, r *http.Request
 	}
 
 	u.Password = ""
+	if !u.Perm.Admin {
+		u.Scope = ""
+	}
 	return renderJSON(w, r, u)
 })