OIDC in 4.1.0 and problems with claims

[Cantor, Scott]

FWIW, my read of the code is that on the front-end it detects whether the attribute-release interceptor is enabled, and embeds that answer in the code/tokens so that the back-channel detects whether it was on and needs to fetch a consent record, so either there's a bug or I have to assume it's on and you're using client-side storage.

That doesn't work, so that would be necessary to work around either for testing or for real by toggling on the encodeConsentInTokens profile option, which I just added to the docs since it didn't get documented.

Or of course there are bugs, but this is how I think it's supposed to work. The assumption more or less is that client-side storage and consent obvously don't really go together, so most people wouldn't run into that combination and need to work around it. (That's one of the reasons I yanked consent from the defaults since we ship with client-side everything and it was just kind of silly to have it on.)

-- Scott