region name `nonce` to `idSiteNonces`
use “token” not “JWT” in error messages that end-users are likely to see
use `callbackUri` for public interface

cb_uri is still used within the initial token, as the api expects that
rework the documentation for createIdSiteUrl options