if no client_id found in qs, send the bad_request html back.