title: Creating and validating at_hash with salt
body: <p>When I'm creating an <code>at_hash</code> of an access token, should the hash be salted or not? If yes, how can it then be validated if the client does not know the salt that was used? The <a href="http://openid.net/specs/openid-connect-core-1_0.html#rfc.section.3.1.3.6" rel="nofollow">specs</a> does not say much about it, unfortunately.</p>