Was talking with keturn in #openid , and it seems that the spec currently doesn't indicate how 30x redirects should be handled. More specifically, how deep an OpenID-enabled application should follow redirects before giving up. ~ Marv