Don't pass in user because we don't know who user is

src/Grant/ImplicitGrant.php

@@ -155,8 +155,7 @@ class ImplicitGrant extends AbstractAuthorizeGrant
         $scopes = $this->scopeRepository->finalizeScopes(
             $scopes,
             $this->getIdentifier(),
-            $client,
-            $authCodePayload->user_id
+            $client
         );
 
         $stateParameter = $this->getQueryStringParameter('state', $request);