Michiel de Jong

also @RubenVerborgh please re-review

@kjetilk @Mitzi-Laszlo @timbl @justinwb: we need one more of you to approve this before it can be merged.

  | TLS | OpenID Connect | OpenID Connect + TLS Bridge -- | -- | -- | -- Solid Client App Developer | MAY | MUST | IDP | MAY...

This PR only corrects the context about webid-oidc-spec, the mention of "secondary" webid-tls as per that table will go into https://github.com/solid/solid-spec/pull/171

@timbl can we merge this now? This only removes references from this spec, the bigger change is in solid/solid-spec#171

cc @sylvainlb about server-side clients

There are two distinct proposals being discussed here: * Dmitri's proposal, to set the client_id to the app origin. I agree this fixes a problem in the web app flow....

Great, I think we all agree then. :) Created issues on two implementations of this spec, to follow this new recommendation. We should also edit the spec text to include...

In the end we decided that the resource server should look at the issuer of the PoP token. The token validation library will additionally check that is issuer is included...

@kjetilk @timbl @justinwb @RubenVerborgh: two of you need to approve this before it can be merged.