massive changes, removed custom errors and changed entire sdk to use client_id with the intention that access_tokens are returned from oauth and only used for extended user centric permissions