[openid-provider] Reject no-encryption association sessions over http
[openid-provider] Reject no-encryption association sessions over http

- Reject no-encryption association sessions over http, to avoid eavesdropper
and to meet the point 8.4.1 of the specification of OpenID 2.0

adieu/authentic2,pu239ppy/authentic2,incuna/authentic,incuna/authentic,BryceLohr/authentic,adieu/authentic2,adieu/authentic2,incuna/authentic,pu239ppy/authentic2,BryceLohr/authentic,adieu/authentic2,BryceLohr/authentic,pu239ppy/authentic2,pu239ppy/authentic2,incuna/authentic,incuna/authentic,BryceLohr/authentic