Migrated from SEC-1729
Rob Winch said:
Supercedes SEC-1710 since openid4java 0.9.6 no longer uses HttpClient3 and there is no viable way of calling shutdown short of rewriting a good portion of openid4java
Supersedes SEC-1711 since openid4java 0.9.6 already requires that attribute exchange parameters are signed.
This issue supersedes #1946
This issue supersedes #1947