OAuth authorization URL checks fail on some valid urls

[wmurphyrd]

https://immers.space/auth/authorize?response_type=token&client_id=&redirect_uri=https%3A%2F%2Flocalhost%3A8443%2Fdoc%2FREST%2Foauth2-redirect.html

this url gives 400, but an empty client_id is supported for anonymous clients. Currently only works with client_id=undefined

https://immers.space/auth/authorize?response_type=token&client_id=undefined&redirect_uri=https%3A%2F%2Flocalhost%3A8443%2Fdoc%2FREST%2Foauth2-redirect.html

this gives 500 due to missing scope arg, but it should give 400 instead