Postel - be liberal in what you accept. Allowing verify calls that are a mix of POST and GET

bin/verifier

@@ -71,8 +71,8 @@ app.use(express.bodyParser());
 app.post('/verify', function(req, resp, next) {
   req.body = req.body || {}
 
-  var assertion = req.body.assertion;
-  var audience = req.body.audience;
+  var assertion = (req.query && req.query.assertion) ? req.query.assertion : req. body.assertion;
+  var audience = (req.query && req.query.audience) ? req.query.audience : req.body.audience;
 
   if (!(assertion && audience))
     return resp.json({ status: "failure", reason: "need assertion and audience" });