build authorisation request URL more carefully

- URL encode all parameters
- add client_id parameter
- merge query string with possibly existing query string in the base URL

This now works with the remote storage implementation of 5apps.com .