feat: authentication using CSP

[LukeWinikates]

• [x] needs orgID option
• ~support ALL PERMISSIONS scope~ we dropped the SDK-side scope check instead, because it's redundant given that the server will be doing the checks.