docstring on provider
authenticate_client and validate_scopes
fix when user dennied access
add handle unknown response. fix #4