tweaks to get server talking to external Java (mitreid) and passport-openid clients

A couple of small OIDC differences from one spec and one draft spec, as well as loosening config requirement on external providers being mandatory. Also fixed some data leakage from auth screen.