removed default_acr, removed default_max_auth_age, clarified signing and encryption URLs

closes #10
closes #16
changed token_endpoint_auth_method to token_endpoint_auth_type to match OIDC
updated date and references
adds context parameter and opens door for others, closes #23
references, style
changed user_id to subject to follow JWT
clarified introduction and background, closes #24
clarified use of client auth in example, closes #22
slightly clarified good/bad token responses, closes #21