allow sending checkid responses with different identity.

This is handled properly by a fair number of OpenID 2.0 RPs. It allows
the provider to support identifier selection even if a different
identifier was passed.

This commit also adds a safety check ensuring that claimed_id is reset
when OP-local identifier is changed and no other claimed_id is directly
provided. This safeguards the servers from claimed_id theft.