Basic 3.2.3 - error response recipient not specified

[Former user]

Section 3.2.3 says that an "error MUST be returned by the Identity provider". It is not specified whether this should be directed to the user, or a redirect to the client.

It should probably point to OAuth 2 section 4.2.2.1 (the error response for the implicit grant authorization request).

[Nat Sakimura]

Drop this sentence.

[Edmund Jay]

fixes #69

→ 00153bde3552