Consider switching to org.apache.http core

[Vladimir Dzhuvinov]

https://hc.apache.org/httpcomponents-core-ga/httpcore/apidocs/

[Thomas Zimmermann]

I'd argue against this. Only depending on the JDK (HttpURLConnection) simplifies integrating oauth2-oidc-sdk into existing projects a lot, because the likelihood of version conflicts is greatly reduced (see #231).

In the future, a switch to the new HTTP Client might make sense if performance or maintainability problems arise. But if they don't, I'd err on the side of complexity inside the library instead of on the consumer side.

[Yavor Vasilev]

See Thomas Zimmermann comment, stay with HttpUrlConnection for now, maybe HTTP Client when we reach Java 10 (not anytime soon).