Registration 4.1 redirect_uri should REQUIRED rather than OPTIONAL

[Nov Matake]

OAuth 2.0 (draft 22) required redirect_uri registration for public clients and confidential clients which utilize implicit flow. http://tools.ietf.org/html/draft-ietf-oauth-v2-22#section-3.1.2.2

So Connect also should require redirect_uri at dynamic client registration. It can be still OPTIONAL for confidential clients which won't utilize implicit flow though.

[Nat Sakimura]

Fix #300 - Registration 4.1 redirect_uri should REQUIRED rather than OPTIONAL

→ 6bfcb7243691

[John Bradley]

The reason this was optional is for clients that use other flows or post message.

A public client needs to register js_origin_uri or redirect_uri

It is optional for the code flow.

I don't think making it REQUIRED for everything is correct.

[Nov Matake]

OK, so "either redirect_uri or js_origin_uri is REQURED"? I got only "type" and "contact" from a RP last week, and I had no idea what should happen in that case..

[John Bradley]

fixes #300 removed js_origin_uri Made redirect_uri required only for fragment encoded responses

→ 4eda43c338c2