Thanks! I am not sure if it makes a difference, but I can also specify the scope in the client config:

https://gist.github.com/bryantp/4b3dadb17c620d301109859fd92c4539#file-application-yml-L16

The request URL then becomes:

http://localhost:8080/uaa/oauth/authorize?client_id=myApp&redirect_uri=http://localhost:8081/login&response_type=code&scope=uaa.admin%20openid&state=QUHpO2

Full HAR file:

https://dl.dropboxusercontent.com/u/4177525/request-with-scopes.har

However, I still only get the OpenID auth/scope on the UAA auth page.