add client authentication steps

[AIIX]

• Listen for needs_credentials, if so show a form so users can enter client_id and client_secret
• Always send skill_id and app_id with all calls