added consent! consent is always a good thing

for each app a user logs in to, it stores which scopes were granted. the user can then open the app from their homepage, or revoke the app’s access (which deletes all access tokens). - as shown, once I revoke tokens, the test app can no longer read my profile :D