make claims parsing really optional (jwt vs. id_token)
ignore build artifacts
register all supported response_types during client registration and try
to pick the one that matches the configured default; use long timeouts
on JWK retrieval calls; source formatting
allow for non-null but empty query parameters on implicit authorization
responses; replace strcmp calls with apr_strnatcmp
simplify azp/aud and nonce handling