include auth links
only use oauth when a client is provided; fix urn
use root links to find credentials endpoints; add a destroy-cred method