Added documentation about TLS
Added X-Frame-Options header to the consent page
Added cache headers to token requests
formatting
Encode state parameter correctly
Typo in constant
Prevent redirect to invalid urls