bugfix() http://tools.ietf.org/html/rfc6749#section-5.1

The authorization server MUST include the HTTP "Cache-Control"
   response header field [RFC2616] with a value of "no-store" in any
   response containing tokens, credentials, or other sensitive
   information, as well as the "Pragma" response header field [RFC2616]
   with a value of "no-cache".
Merge branch 'bugfix/rfc6749-section5.1' into feature/openid-connect
feature(oidc) Separate OIDC Extension data handler from OAuth2 handler

* Created separate OIDC intended handler so interface is not broken on
  existing applications.
* Push ID Token generation into handler. Token generation contains quite
  a few implementation specific components that are better left to the
  consumer of this library.
feature(oidc) Properly override token endpoint response
feature(oidc) simplify exception case matching
feature(oidc) Need to pass authenticated user to request handler
chore() Remove unused import