WIP feat: Check for required OAuth parameters on startup.

If either `scope` or `client_id` is missing/invalid, send the user to `/400.html` and show them an error message.

* Add the 400.html page.
* Check for required parameters in the OAuth relier.
* If the `client_id` is invalid, show the user `Unknown client`
* Augment necessary errors with a `redirect` field. In app-start.js, if the error has the `redirect` field, redirect there instead of the 500 page.

Add one new OAuth errors:
* 1005 - MISSING_PARAMTER - reported error will contain a .param field.

fixes #1740
Perhaps not for this PR, but it would be nice if we could create 3 base error types, AuthError, OAuthError, and ProfileError. From AuthError, we could create 2 child error types, InvalidParameterError and MissingParameterError. They would know how to fetch their translation context.