The scopes this session provides access to.
These are not connected to the authUser, and can for example represent a subset of their permissions.
authUser
Set<String> scopeNames;