This adds a new `mode` parameter that controls whether the application behaves as a confidential, public, or localhost client. This means we now require HTTPS for confidential mode, disallow client_id for localhost, etc.