Cleanup deprecated

Motivation for making app_id, app_secret optional: the only thing in the API that requires it is debug_token, which we don't use. For cleaner code and security it's better not to require the caller to expose credentials they don't need or use confusing fake dummy values.