Improved handling of prompt parameter

[equist]

I suggest improvments in handling of the prompt parameter:

1. max_age parameter should be handled the same way as prompt=login
2. The login UI should be able to know the requested prompt values (and max_login), but still not re-trigger the login from the callback endpoint.
3. prompt=create should be validated so that it is not combined with other prompt values
4. prompt=create should display create account page
5. Unsupported prompt values should return error to client