avoid segfault on corrupted/non- JSON/JWT input
add draft implementation of OP-initiated-SSO based on

based on:
http://tools.ietf.org/html/draft-bradley-oauth-jwt-encoded-state-00