anchor.diff:  <3> When `true`, unauthenticated token requests from web clients (like the web console) will be redirected to Google to log in.
   <4> The client id of a link:https://console.developers.google.com/[registered Google project]. The project must be configured with a redirect URI of `<master>/oauth2callback/<identityProviderName>`
   <5> The client secret issued by Google.
  -
  -==== OpenID Connect [[OpenID Connect]]
  +====
  +
  +==== OpenID Connect [[OpenID]]
   
   `OpenIDIdentityProvider` integrates with an OpenID Connect identity provider, using an link:http://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth[Authorization Code Flow].
   
  
positive.code: <5> List of claims to use as the display name. First non-empty claim is used.
  <6> List of claims to use as the email address. First non-empty claim is used.
  <7> link:http://openid.net/specs/openid-connect-core-1_0.html#UserInfo[UserInfo Endpoint] described in the OpenID spec. Must use https.
  
  === Token options
  
  
negative.code: Note that using GitHub as an identity provider requires users to get a token using `<master>/oauth/token/request` to use with command-line tools.
  
  Master config:
  ====
  ----
  oauthConfig:
    ...
  