OpenIdConnectProtocolValidator
1. has checks for optional claims, exposed as properties in JwtPayload for easy access
2. throws if nonce is required and missing or whitespace.