Messages 2.1.1.1.2, etc. - Possible changes to max_age

[Michael Jones]

1. Should we move max_age up from being in the id_token member of the request object to being a top-level member of the request object?

2. Should we allow max_age to be specified a request parameter without using the request object?

3. Should requesting max_age have a side effect of requiring the auth_time claim?

[Michael Jones]

The working group decided to make these changes.

[Michael Jones]

Fixed #744 - Promoted "max_age" to being a top-level parameter

→ <<cset 70e64294c06e>>