Do return empty scopes directely when the grant type is refresh_token even no user identifier is provided.
Closes #3509299