[security] One time form tokens

[Martin Atkins]

David Fuelling wrote:
> Are these (and other best practices for OP/RP's) being compiled 
> somewhere (like on the wiki)?  I think this has been answered, but I'm 
> not sure.
> 

We have a page listing some best practices for Relying Parties:

     <http://openid.net/wiki/index.php/Relying_Party_Best_Practices>

Feel free to start a similar page for OpenID Providers. :)