Support client certificate authentication on token endpoint

[leastprivilege]

for user or client authentication? or both?

[krippz]

HI
I would like to have both, since that would give me much more flexibility when choosing what type to use for a particular use case.

[brockallen]

For reference: #295.

[leastprivilege]

For user authentication is can be done using PreAuthenticateAsync.

For client authentication the client validator needs to be extended. scheduled for 1.1

[leastprivilege]

Spiked and working - but postponed to 2.0 since it incurs a breaking change

see #847

[leastprivilege]

pretty much done - need some tests and better instructions for the sample

[Cont3xtSw1tch]

@leastprivilege you have any samples for the user authenitcation to play around with?