rollback. keep the same API as client does. solve #14
clean up validator attrs
tests on invalid scopes
provider docs finished.