Compliance test -- allow for unsigned request objects?

[jjg-123]

In compliance testing, unsigned JSON object may be allowed (if we feel like it). Do we want to do this? the example they used is

https://serge.ncsa.illinois.edu:443/oauth2/authorize?request=eyJhbGciOiJub25lIn0.eyJzY29wZSI6Im9wZW5pZCIsInJlc3BvbnNlX3R5cGUiOiJjb2RlIiwicmVkaXJlY3RfdXJpIjoiaHR0cHM6XC9cL3d3dy5jZXJ0aWZpY2F0aW9uLm9wZW5pZC5uZXRcL3Rlc3RcL2FcL09BNE1QX0JBU0lDXzFcL2NhbGxiYWNrIiwic3RhdGUiOiJDbmM0b2FQNVIxIiwibm9uY2UiOiJRN3A2dFNqUVd1IiwiY2xpZW50X2lkIjoic2VyZ2U6b2lkYy1jb21wbGlhbmNlIn0.&client_id=serge:oidc-compliance&redirect_uri=https://www.certification.openid.net/test/a/OA4MP_BASIC_1/callback&scope=openid&response_type=code

which has a 

header:
{"alg":"none"} payload:
{"scope":"openid","response_type":"code","redirect_uri":"https:\/\/www.certification.openid.net\/test\/a\/OA4MP_BASIC_1\/callback","state":"Cnc4oaP5R1","nonce":"Q7p6tSjQWu","client_id":"serge:oidc-compliance"}
So the payload is largely the same (note that the required parameters of client_id etc are still passed as parameters, but optional ones like state and nonce are in the payload).