Remove need for additional metadata

[PieterKas]

As discussed at IETF 121, the editors concluded that there is no need for additional metadata and that the trust decisions (e.g. expect the authorization server to always bind tokens) is a policy and configuration issue that should be handled outside the spec.