WIP feat: Check for required OAuth parameters on startup.

If either `scope` or `client_id` is missing/invalid, send the user to `/400.html` and show them an error message.

* Add the 400.html page.
* Check for required parameters in the OAuth relier.
* If the `client_id` is invalid, show the user `Unknown client`
* Augment necessary errors with a `redirect` field. In app-start.js, if the error has the `redirect` field, redirect there instead of the 500 page.

Add two new OAuth errors:
* 1005 - Missing `client_id`
* 1006 - Missing `scope`

fixes #1740
404->400