Release 11.0.2
- Add configuration property to disable auth_time validation in refresh flows with Azure B2C (Azure B2C implements this incorrectly)
- Fix disable at_hash validation in refresh, this is not a required property
- only use revocation endpoint if supported by the STS