Possible OIDC Provider PR

Hi!

I am currently using this project as the basis for an OIDC provider, but because this project's issuer seems to just implement OAuth 2.0, my server has to wrap /authorize and /token and patch their responses. I think this project could be very useful for people making custom OIDC providers, and the changes required to support that use case are minimal:

1. Remember "nonce" parameter in /authorize
2. Mint "id_token" in and return it alongside the "access_token" in the /token handler.
3. A callback next to "success", which gets a "client_id" and optionally "client_secret" and decides whether the /token endpoint should allow that request based on whether the client is public or private and if private whether the client_secret is correct.

In light of this, would you be open to a PR with minimal patches required to support OIDC and automated integration tests which run the OIDC conformance suite against the resulting package?

Thanks!