45d4598e accidentally removed the OAuth2.0 access permission check based on Client.required_group. This change adds it again.