Downscope tokens before sending them to app-remoting host.

remoting/webapp/crd/js/identity.js

Index: remoting/webapp/crd/js/identity.js
diff --git a/remoting/webapp/crd/js/identity.js b/remoting/webapp/crd/js/identity.js
index 742a552d6bb29825fe19d37d0fcf8e71e9515ea3..d53a0395d010e372a7eaf4ffc22a0dfa284fd7db 100644
--- a/remoting/webapp/crd/js/identity.js
+++ b/remoting/webapp/crd/js/identity.js
@@ -83,14 +83,16 @@ remoting.Identity.prototype.getToken = function(opt_scopes) {
 /**
  * Gets a fresh access token.
  *
+ * @param {Array<string>=} opt_scopes Optional OAuth2 scopes to request, as
+ *     documented in getToken().
  * @return {!Promise<string>} A promise resolved with an access token
  *     or rejected with a remoting.Error.
  */
-remoting.Identity.prototype.getNewToken = function() {
+remoting.Identity.prototype.getNewToken = function(opt_scopes) {
   /** @type {remoting.Identity} */
   var that = this;
 
-  return this.getToken().then(function(/** string */ token) {
+  return this.getToken(opt_scopes).then(function(/** string */ token) {
     return new Promise(function(resolve, reject) {
       chrome.identity.removeCachedAuthToken({'token': token }, function() {
         resolve(that.getToken());