The Scripting API defines a Expand Thing Init, but currently, our ExposedThing stops at step 3. We should align it with the spec.

p.s. This causes #873, because the HTTP server receives a Thing object without any scheme defined when the CLI module tries to create the Servient Thing using a very simple ExposeThingInit without a security scheme.