Remove client secret aspect

Don't know what I was thinking.
Add a convenience credential accessor for the authenticator

Originally thought doing so would be insecure, but
the callback already exposes it to the app
developer.
Refactor and expose base nation url format
Sync the authenticator's base url with the client's