schemeless URLs and discoverAuthorizationEndpoint()

[jonnybarnes]

The method discoverAuthorizationEndpoint() fails when passed a schemeless URL such as aaronparecki.com.

[aaronpk]

I'm not sure it's safe to assume a scheme if none is present. Technically everything should be https, but it seems weird to automatically add that if no scheme is present.

[jonnybarnes]

It would strike me as most sensible to pass http:// as the scheme, then follow a redirect to https:// if the server sends one.

One may even consider monitoring for HSTS headers, but that would require some kind of cache/storage of which sites have sent such a header.