WIP feat: Check for required OAuth parameters on startup.

If either `scope` or `client_id` is missing/invalid, send the user to `/400.html` and show them an error message.

* Add the 400.html page.
* Check for required parameters in the OAuth relier.
* If the `client_id` is invalid, show the user `Unknown client`
* Augment necessary errors with a `redirect` field. In app-start.js, if the error has the `redirect` field, redirect there instead of the 500 page.

Add one new OAuth errors:
* 1005 - MISSING_PARAMTER - reported error will contain a .param field.

fixes #1740
This is a change from the current behavior. nginx serves up the 500 page, I pulled it out here so that we could add some logging around errors that we see.