         response_type: 'token'
         redirect_uri: SSO_CALLBACK_URL
         client_id: SSO_CLIENT_ID
-        scope: ''
+        #scope: 'publicData'
+        scope: 'publicData characterStatisticsRead'
         state: 'testState'
 
       ssoUrl = "#{SSO_HOST}/oauth/authorize/?#{qs.stringify ssoParams}"


      socialMiscPanel = React.createElement(SocialMiscPanel, {stats: @state.stats})

      rawStatsList = React.createElement(RawStatsList, {stats: @state.stats})

      dom.div {className: 'container'},

    hash = window.location.hash.substring(1)
    queryParts = qs.parse(hash)
    if queryParts.access_token
      token = queryParts.access_token
      @setState {ssoState: 'loading', token: token}
      # set up default ajax configurations
      $.ajaxSetup({
          accepts: "application/json, charset=utf-8"
          crossDomain: true
          type: "GET"
          dataType: "json"
          headers:
            Authorization: "Bearer #{token}"
          error: (xhr, status, error) ->
              console.error(error);
      })
      # get the character URL from decode
      $.getJSON CREST_HOST, (data, status, xhr) ->
        console.log data
      $.getJSON "#{CREST_HOST}/decode/", (data, status, xhr) =>
        charUrlParsed = urlParse data.character.href
        [ foo, foo, characterId ] = charUrlParsed.path.split '/'
        @setState {character: {id: characterId, name: characterId}}
        statsUrl = data.character.href + "statistics/year/2014/"
        $.getJSON data.character.href, (data, status, xhr) =>
          console.log data
        $.getJSON statsUrl, (data, status, xhr) =>
          stats = new CharacterStats(data)
          @setState {stats: stats, year: 2014, ssoState: 'loaded'}
          console.log data
          console.log status

  loadData: ->
    source = "null_pvp"
    source = _.sample samples
