Changing Authenticate call to be per-IIdentity
Extra IDictionary<string,object> becomes IDictionary<string,string>

Because the values must round-trip through lots of media
(serialized in cookie, serialized to opaque querystring "state"
value, etc) using <string,string> is more deterministic and is
what will actually come back to you
Can't use Claims as a type before net45

Also needed IDictionary<string,string> to augment challenge