externalized application CSS, closes #221

added favicon, cleaned up header and footer code
added null check and permissions check to ID token generation, closes #602
fix dynamic registration of public clients
enforce clients using a redirect flow have at least one redirect uri registered when using dynamic registration, made error handling more consistent across all APIs

closes #596