point implementers to OIDC in intro

[dickhardt]

[dickhardt]

@aaronpk remind me what we were going to do here?

[aaronpk]

I think the idea was to at least mention that OIDC exists as a common extension of OAuth that is useful for user authentication

[aaronpk]

Update this paragraph:

OAuth is an authorization protocol, and is not an authentication protocol. The access token represents the authorization granted to the client. It is a common practice for the client to present the access token to a proprietary API which returns a user identifier for the resource owner, and then using the result of the API as a proxy for authenticating the user. This practice is not part of the OAuth standard or security considerations, and may not have been considered by the resource owner. Implementors should carefully consult the documentation of the resource server before adopting this practice.

[dickhardt]

OAuth is not authentication -- refer to OIDC for auth