add anti-forgery to initial config page
fix HRD bug when RP passes wreply
friendly message on signout page
show signout page if problem with validating reply to for RP in HRD signout
validate wreply against RPs signed into to on WS-Fed signout
only add default claims if caller has not provided them