If user sets TokenValidationParameters.TokenReplayValidator, it should be called

[brentschmaltz]

If a users has set TokenValidationParameters.TokenReplayValidator delegate, it should be called.
Currently, the user has to set the delegate AND set TokenValidationParameters.ValidateTokenReplay

This could be solved by setting the default to true || examining both values.

[mafurman]

We will make this change in 6.x after we add "appsettings" runtime control. We want the Validators to have consistent behavior.

If the user sets a Validator we call it, and then we check the associated bool afterwards.

if (ValidatorDelegate)
    call delegate
if (!Validate)
    return
....

[mafurman]

We should also add in comments on the TokenValidationParameters that clearly indicate that the 'Validate' properties refer to our default validation behavior, and that the 'ValidatorDelegate' properties take over validation (and do not occur in addition to our default validation behavior).