update to draft-bradley-oauth-jwt-encoded-state-01 and fix nonce cache

- add implementation of OP-initiated-SSO based on:
  http://tools.ietf.org/html/draft-bradley-oauth-jwt-encoded-state-01
- fix nonce caching for replay prevention
doc corrections to auth_openidc.conf