Add id_token as claim AspNetCore OpenIdConnect middleware
<p>I am trying to set <code>IdTokenHint</code> when sending the sign out request. In the previous <code>Microsoft.Owin.Security.OpenIdConnect</code> middleware I would be able to set the <code>id_token</code> as a claim in the <code>SecurityTokenValidated</code> method using the <code>SecurityTokenValidated</code> notification by doing something like this: 
</p>

<pre><code>app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
{
    ...
    Notifications = new OpenIdConnectAuthenticationNotifications
    {
        //Perform claims transformation
        SecurityTokenValidated = async notification =&gt;
        {
            ...
            notification.AuthenticationTicket.Identity.AddClaim(new Claim("id_token", notification.ProtocolMessage.IdToken));
        },
        RedirectToIdentityProvider = async n =&gt;
        {
            if (n.ProtocolMessage.RequestType == OpenIdConnectRequestType.LogoutRequest)
            {
                var idTokenHint = n.OwinContext.Authentication.User.FindFirst("id_token").Value;
                n.ProtocolMessage.IdTokenHint = idTokenHint;
             }
         }
    }
}
</code></pre>

<p>With the new middleware <code>Microsoft.AspNetCore.Authentication.OpenIdConnect</code> (in ASP.NET Core RC2) I am having trouble trying to accomplish the same thing. I am assuming I should tap into the <code>Events</code> like so. 
</p>

<pre><code>app.UseOpenIdConnectAuthentication(new OpenIdConnectOptions
{
    ...
    Events = new OpenIdConnectEvents()
    {
         OnTokenValidated = context =&gt;
         {
             ...
             context.SecurityToken.Payload.AddClaim(new Claim("id_token", context.ProtocolMessage.IdToken));
          },
          OnRedirectToIdentityProviderForSignOut = context =&gt;
          {
                var idTokenHint = context.HttpContext.User.FindFirst("id_token").Value;
                context.ProtocolMessage.IdTokenHint = idTokenHint;
        }
     }
 }
</code></pre>

<p>The problem I'm seeing is that the claims do not remain on the <code>SecurityToken</code> and don't get set on the <code>HttpContext.User</code>. What am I missing?</p>