AspNet-OpenIdConnect-Server/Owin.Security.OpenIdConnect.Server — pull request #44 by PinpointTownes (2014-08-10 22:06:30+00:00)
Title: Allow mixing response_mode and response_type to make OpenIdConnectServerHandler fully specs-compliant

This PR is the final step to support `response_mode` independently of `response_type` and thus make `OpenIdConnectServerHandler` respect the following specs:
* http://openid.net/specs/oauth-v2-multiple-response-types-1_0.html
* http://openid.net/specs/oauth-v2-form-post-response-mode-1_0.html
* http://openid.net/specs/openid-connect-core-1_0.html

Major changes:
* An initial check has been inserted in `InvokeAuthorizeEndpointAsync` to ensure a supported `response_mode` is provided.

* `InvokeTokenEndpointAsync` has been totally reworked to allow mixing `response_mode` and `response_type`. When `response_mode` is null or empty, a default response mode is determined using the `response_type` parameter: _query_ for the authorization code flow and _fragment_ for the implicit and hybrid flows.

* `OpenIdConnectMessage` has replaced the payload dictionary.

* A new `ApplyAuthorizationResponseAsync` method has been created to forge the appropriate response.

* `OpenIdConnectAuthorizationEndpointResponseContext` has been renamed to `OpenIdConnectAuthorizeEndpointResponseContext` to make it consistent with `OpenIdConnectAuthorizeEndpointContext`.

* `OpenIdConnectSendFormPostMarkupContext`, `DefaultBehavior.SendFormPostMarkup` and `IOpenIdConnectServerProvider.SendFormPostMarkup` have been removed. The default logic has been transferred in `ApplyAuthorizationResponseAsync` and can be overridden via `IOpenIdConnectServerProvider.AuthorizeEndpointResponse` (`OpenIdConnectAuthorizeEndpointResponseContext.RequestCompleted` can be called to stop processing the request and render a custom autopost form).