Adding public constant for "Bearer"
Validating redirect_uri, disallowing http by default

Also de-duplicating bearer challenge header going out
Append WWW-Authenticate rather than concatinate
Removing de-duplication logic - AppendValues should be sufficient
Diagnostics: Validate welcome page arguments.
Hosting: Add parameter validation for WepApp.Start.
OAuth: TokenEndpointRequest needs to use Scope instead of Code parameter.
Twitter: Make the pinned cert validator the default option.
Build: Fix rtw suffix.
Ms.Owin: Enable accessing the request form multiple times.
Cors: Fix nuspec dependency version for rtw.