broke out the cookie handling into a class of its own.
Added AuthnBroker class and tests for it.
Replaced the single authnmethod specification with usage of an authn broker.
Extended Authz handling sligthly.
client id and secret information should be kept in the client database and not in the session database.
Made all the tests run OK