Cleanup deprecated

Motivation for making app_id, app_secret optional: the only thing in the API that requires it is debug_token, which we don't use. For cleaner code and security it's better not to require the caller to expose credentials they don't need or use confusing fake dummy values.

Note this change won't break code for existing consumers.