Add client access tokens, add support for non-root JSON responses

Client access tokens are required for certain ID API endpoints. This
commit adds support for those.

The ID API also returns nested objects. The JSON parser now supports
extracting data from non-root JSON fragments.
Fix ID conf for domain, add conf to returnUrlVerifier