Merged in danielfett/fapi2/fix-508 (pull request #358)
Fixes https://bitbucket.org/openid/fapi/issues/508/security-goals-requirements-shalls-may
Fixes https://bitbucket.org/openid/fapi/issues/508/security-goals-requirements-shalls-may