Aparently i forgot to add it, it gets a list of muted users

Improved missing "scopes" param handling.
Allowed "any of" / "all of" mode specification in OAuthScopesPlug.
Fixed auth UI / behavior when user selects no permissions at /oauth/authorize.

this allows to open private activities by URL when you are logged in,
and to let the FE display a 404 page

```
# Only return statuses that have been pinned
GET /api/statuses/user_timeline.json?pinned=true

# Pin
POST /api/statuses/pin/:id

# Unpin
POST /api/statuses/unpin/:id
```

Code style: remove wrapping function of outbox

Added tests for `confirm_email` action.