Things to do

TODO items from source
RP validation
Test suite. Replicate OSIS I5 suite if possible
Convert this TODO list into GitHub issues ;-)
PAPE?
SReg?
Check nonce expiry time in check_auth

Refactorings

Maybe stick 'request' on 'req' as 'req.openid' or so

OSIS Testing conformance

See wiki