We should step back and make sure our handling of `service` and `client_id` is consistent and the way we want it. `service` was wedged in there as a (premature?) placeholder when defining `v1` of the auth server API. I'll try to do some higher level thinking about this.