Fix for missing X-XRDS-Location Headers

Some providers (at least Steam and Google) don't provide an
X-XRDS-Location Header on their response, instead they directly
return the XRDS-Document. So in case we don't find the header
just use the claimed_id to retrieve the XRDS-Document and parse
the document for the OpenID endpoint.