Improvements to client auth error logging

[ErisDS]

The main point of this PR is to output a useful error in the server console whenever an error occurs during the client auth flow.

There are quite a few different things that can be wrong. I've now got it so that there's a different error for:

1. client credentials missing
2. client credentials invalid
3. url mismatch

In the first two cases, the error sent to the client is just 'Access denied'. The nice error only appears on the server.

In the latter case we already have a much nicer error for the client.

Please note: I also added one other change to this whilst I was there - I made the localhost override only work for non-production blogs. I think that makes sense?

no issue

• If client credentials are missing, or not valid, output a clear message in the server console
• Still defaults to sending the 'access denied to url' error to the frontend

[ErisDS]

Removed my derpy switch back to localhost only being for production, and added a comment so I don't forget this again.