* fix: append client id to aud * handle new callback path Co-authored-by: Livio Amstutz <livio.a@gmail.com>