Explicitly describe how desktop/mobile clients can use account-portability functionality with OAuth and client_id etc

[lisad]

They can't provide a cert like servers do, so will it be a fixed string? @ThisIsMissEm input welcome