Allow the client to set the client_id as a get parameter so we can dynamically know what origins should be allowed in the CORS handshake