Merge branch 'v3.3'

40 files changed, 167 insertions, 145 deletions

diff --git a/build.proj b/build.proj
index c0321ad..d6a5101 100644
--- a/build.proj
+++ b/build.proj
@@ -170,6 +170,7 @@
 																			 or '%(Extension)' == '.config'
 																			 or '%(Extension)' == '.Master'
 																			 or '%(Extension)' == '.aspx'
+																			 or '%(Extension)' == '.ascx'
 																			 or '%(Extension)' == '.asax'
 																			 or '%(Extension)' == '.ashx'
 																			 ">
diff --git a/lib/DotNetOpenAuth.BuildTasks.targets b/lib/DotNetOpenAuth.BuildTasks.targets
index b23542b..2b4aebb 100644
--- a/lib/DotNetOpenAuth.BuildTasks.targets
+++ b/lib/DotNetOpenAuth.BuildTasks.targets
@@ -4,7 +4,7 @@
 		<ProjectRoot Condition="'$(ProjectRoot)' == ''">$(MSBuildProjectDirectory)\..\..</ProjectRoot>
 	</PropertyGroup>
 	<ItemGroup>
-		<VsTemplateParameterReplaceExtensions Include=".cs;.csproj;.sql;.config;.Master;.aspx;.vb;.asax;.ashx" />
+		<VsTemplateParameterReplaceExtensions Include=".cs;.csproj;.sql;.config;.Master;.aspx;.ascx;.vb;.asax;.ashx" />
 		<VsTemplateProjectItemTypes Include="Compile;EmbeddedResource;EntityDeploy;Content;None" />
 	</ItemGroup>
 
diff --git a/projecttemplates/RelyingPartyLogic/Database.cs b/projecttemplates/RelyingPartyLogic/Database.cs
index 9ef72eb..f162b95 100644
--- a/projecttemplates/RelyingPartyLogic/Database.cs
+++ b/projecttemplates/RelyingPartyLogic/Database.cs
@@ -8,6 +8,7 @@ namespace RelyingPartyLogic {
 	using System;
 	using System.Collections.Generic;
 	using System.Data;
+	using System.Data.EntityClient;
 	using System.Data.SqlClient;
 	using System.Linq;
 	using System.ServiceModel;
@@ -37,21 +38,8 @@ namespace RelyingPartyLogic {
 				DatabaseEntities dataContext = DataContextSimple;
 				if (dataContext == null) {
 					dataContext = new DatabaseEntities();
-					try {
-						dataContext.Connection.Open();
-					} catch (EntityException entityEx) {
-						var sqlEx = entityEx.InnerException as SqlException;
-						if (sqlEx != null) {
-							if (sqlEx.Class == 14 && sqlEx.Number == 15350) {
-								// Most likely the database schema hasn't been created yet.
-								HttpContext.Current.Response.Redirect("~/Setup.aspx");
-							}
-						}
-
-						throw;
-					}
-
-					DataContextTransaction = dataContext.Connection.BeginTransaction();
+					dataContext.Connection.Open();
+					DataContextTransaction = (EntityTransaction)dataContext.Connection.BeginTransaction();
 					DataContextSimple = dataContext;
 				}
 
@@ -59,14 +47,21 @@ namespace RelyingPartyLogic {
 			}
 		}
 
-		internal static IDbTransaction DataContextTransaction {
+		/// <summary>
+		/// Gets a value indicating whether the data context is already initialized.
+		/// </summary>
+		internal static bool IsDataContextInitialized {
+			get { return DataContextSimple != null; }
+		}
+
+		internal static EntityTransaction DataContextTransaction {
 			get {
 				if (HttpContext.Current != null) {
-					return HttpContext.Current.Items[DataContextTransactionKey] as IDbTransaction;
+					return HttpContext.Current.Items[DataContextTransactionKey] as EntityTransaction;
 				} else if (OperationContext.Current != null) {
 					object data;
 					if (OperationContext.Current.IncomingMessageProperties.TryGetValue(DataContextTransactionKey, out data)) {
-						return data as IDbTransaction;
+						return data as EntityTransaction;
 					} else {
 						return null;
 					}
diff --git a/projecttemplates/RelyingPartyLogic/Model.cs b/projecttemplates/RelyingPartyLogic/Model.cs
index 10c1518..ca87c90 100644
--- a/projecttemplates/RelyingPartyLogic/Model.cs
+++ b/projecttemplates/RelyingPartyLogic/Model.cs
@@ -18,15 +18,17 @@ namespace RelyingPartyLogic {
 		/// <summary>
 		/// Clears the expired nonces.
 		/// </summary>
-		internal void ClearExpiredNonces() {
-			this.ExecuteCommand("ClearExpiredNonces");
+		/// <param name="transaction">The transaction to use, if any.</param>
+		internal void ClearExpiredNonces(EntityTransaction transaction) {
+			this.ExecuteCommand(transaction, "DatabaseEntities.ClearExpiredNonces");
 		}
 
 		/// <summary>
 		/// Clears the expired associations.
 		/// </summary>
-		internal void ClearExpiredAssociations() {
-			this.ExecuteCommand("ClearExpiredAssociations");
+		/// <param name="transaction">The transaction to use, if any.</param>
+		internal void ClearExpiredAssociations(EntityTransaction transaction) {
+			this.ExecuteCommand(transaction, "DatabaseEntities.ClearExpiredAssociations");
 		}
 	}
 }
diff --git a/projecttemplates/RelyingPartyLogic/NonceDbStore.cs b/projecttemplates/RelyingPartyLogic/NonceDbStore.cs
index 2f3c670..951bf0f 100644
--- a/projecttemplates/RelyingPartyLogic/NonceDbStore.cs
+++ b/projecttemplates/RelyingPartyLogic/NonceDbStore.cs
@@ -9,6 +9,7 @@ namespace RelyingPartyLogic {
 	using System.Collections.Generic;
 	using System.Data;
 	using System.Data.Common;
+	using System.Data.EntityClient;
 	using System.Linq;
 	using System.Text;
 	using DotNetOpenAuth.Configuration;
@@ -90,7 +91,7 @@ namespace RelyingPartyLogic {
 		private static void ClearNoncesIfAppropriate() {
 			if (++nonceClearingCounter % NonceClearingInterval == 0) {
 				using (var dataContext = new TransactedDatabaseEntities(IsolationLevel.ReadCommitted)) {
-					dataContext.ClearExpiredNonces();
+					dataContext.ClearExpiredNonces(dataContext.Transaction);
 				}
 			}
 		}
@@ -100,27 +101,27 @@ namespace RelyingPartyLogic {
 		/// </summary>
 		protected class TransactedDatabaseEntities : DatabaseEntities {
 			/// <summary>
-			/// The transaction for this data context.
-			/// </summary>
-			private DbTransaction transaction;
-
-			/// <summary>
 			/// Initializes a new instance of the <see cref="TransactedDatabaseEntities"/> class.
 			/// </summary>
 			/// <param name="isolationLevel">The isolation level.</param>
 			public TransactedDatabaseEntities(IsolationLevel isolationLevel) {
 				this.Connection.Open();
-				this.transaction = this.Connection.BeginTransaction(isolationLevel);
+				this.Transaction = (EntityTransaction)this.Connection.BeginTransaction(isolationLevel);
 			}
 
 			/// <summary>
+			/// Gets the transaction for this data context.
+			/// </summary>
+			public EntityTransaction Transaction { get; private set; }
+
+			/// <summary>
 			/// Releases the resources used by the object context.
 			/// </summary>
 			/// <param name="disposing">true to release both managed and unmanaged resources; false to release only unmanaged resources.</param>
 			protected override void Dispose(bool disposing) {
 				try {
 					this.SaveChanges();
-					this.transaction.Commit();
+					this.Transaction.Commit();
 				} finally {
 					this.Connection.Close();
 				}
diff --git a/projecttemplates/RelyingPartyLogic/RelyingPartyApplicationDbStore.cs b/projecttemplates/RelyingPartyLogic/RelyingPartyApplicationDbStore.cs
index 9a2f8bb..e13633a 100644
--- a/projecttemplates/RelyingPartyLogic/RelyingPartyApplicationDbStore.cs
+++ b/projecttemplates/RelyingPartyLogic/RelyingPartyApplicationDbStore.cs
@@ -134,7 +134,7 @@ namespace RelyingPartyLogic {
 		/// </remarks>
 		public void ClearExpiredAssociations() {
 			using (var dataContext = new TransactedDatabaseEntities(IsolationLevel.ReadCommitted)) {
-				dataContext.ClearExpiredAssociations();
+				dataContext.ClearExpiredAssociations(dataContext.Transaction);
 			}
 		}
 
diff --git a/projecttemplates/RelyingPartyLogic/Utilities.cs b/projecttemplates/RelyingPartyLogic/Utilities.cs
index bbcfc68..57a1baa 100644
--- a/projecttemplates/RelyingPartyLogic/Utilities.cs
+++ b/projecttemplates/RelyingPartyLogic/Utilities.cs
@@ -96,21 +96,38 @@ GO
 			}
 		}
 
+		public static int ExecuteCommand(this ObjectContext objectContext, string command) {
+			// Try to automatically add the appropriate transaction if one is known.
+			EntityTransaction transaction = null;
+			if (Database.IsDataContextInitialized && Database.DataContext == objectContext) {
+				transaction = Database.DataContextTransaction;
+			}
+			return ExecuteCommand(objectContext, transaction, command);
+		}
+
 		/// <summary>
 		/// Executes a SQL command against the SQL connection.
 		/// </summary>
 		/// <param name="objectContext">The object context.</param>
+		/// <param name="transaction">The transaction to use, if any.</param>
 		/// <param name="command">The command to execute.</param>
 		/// <returns>The result of executing the command.</returns>
-		public static int ExecuteCommand(this ObjectContext objectContext, string command) {
-			DbConnection connection = ((EntityConnection)objectContext.Connection).StoreConnection;
-			bool opening = (connection.State == ConnectionState.Closed);
+		public static int ExecuteCommand(this ObjectContext objectContext, EntityTransaction transaction, string command) {
+			if (objectContext == null) {
+				throw new ArgumentNullException("objectContext");
+			}
+			if (String.IsNullOrEmpty(command)) {
+				throw new ArgumentNullException("command");
+			}
+
+			DbConnection connection = (EntityConnection)objectContext.Connection;
+			bool opening = connection.State == ConnectionState.Closed;
 			if (opening) {
 				connection.Open();
 			}
 
 			DbCommand cmd = connection.CreateCommand();
-			cmd.Transaction = (DbTransaction)Database.DataContextTransaction;
+			cmd.Transaction = transaction;
 			cmd.CommandText = command;
 			cmd.CommandType = CommandType.StoredProcedure;
 			try {
diff --git a/projecttemplates/WebFormsRelyingParty/GettingStarted.htm b/projecttemplates/WebFormsRelyingParty/GettingStarted.htm
index 9a3fbb7..c4fb3aa 100644
--- a/projecttemplates/WebFormsRelyingParty/GettingStarted.htm
+++ b/projecttemplates/WebFormsRelyingParty/GettingStarted.htm
@@ -1,19 +1,17 @@
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
-<html xmlns="http://www.w3.org/1999/xhtml" >
+<html xmlns="http://www.w3.org/1999/xhtml">
 <head>
-    <title>Getting started</title>
+	<title>Getting started</title>
 </head>
 <body>
-
 	<p>
-		Your OpenID and InfoCard relying party web site is nearly ready to go. You just 
-		need to create your SQL database where user accounts will be stored.&nbsp; <b>
-		Just build and start your web site </b>and visit Default.aspx.&nbsp; You&#39;ll get 
-		further instructions there.&nbsp;
+		Your OpenID and InfoCard relying party web site is nearly ready to go. You just
+		need to create your SQL database where user accounts will be stored. <b>Just build and
+		start your web site</b> and visit <b>Setup.aspx</b>. You'll get further instructions
+		there.
 	</p>
 	<p>
-		Creating your database is almost totally automated, so it should be a piece of 
-		cake.</p>
-
+		Creating your database is almost totally automated, so it should be a piece of cake.
+	</p>
 </body>
 </html>
diff --git a/projecttemplates/WebFormsRelyingParty/Web.config b/projecttemplates/WebFormsRelyingParty/Web.config
index 1d7c29f..9214ee8 100644
--- a/projecttemplates/WebFormsRelyingParty/Web.config
+++ b/projecttemplates/WebFormsRelyingParty/Web.config
@@ -48,7 +48,7 @@
 		<messaging>
 			<untrustedWebRequest>
 				<whitelistHosts>
-					<add name="localhost" />
+					<!--<add name="localhost" />-->
 				</whitelistHosts>
 			</untrustedWebRequest>
 		</messaging>
diff --git a/samples/OAuthConsumer/Twitter.aspx.cs b/samples/OAuthConsumer/Twitter.aspx.cs
index a4fb0cb..9b9eced 100644
--- a/samples/OAuthConsumer/Twitter.aspx.cs
+++ b/samples/OAuthConsumer/Twitter.aspx.cs
@@ -54,7 +54,7 @@ public partial class Twitter : System.Web.UI.Page {
 
 	protected void downloadUpdates_Click(object sender, EventArgs e) {
 		var twitter = new WebConsumer(TwitterConsumer.ServiceDescription, this.TokenManager);
-		XPathDocument updates = new XPathDocument(TwitterConsumer.GetUpdates(twitter, AccessToken).CreateReader());
+		XPathDocument updates = new XPathDocument(TwitterConsumer.GetUpdates(twitter, this.AccessToken).CreateReader());
 		XPathNavigator nav = updates.CreateNavigator();
 		var parsedUpdates = from status in nav.Select("/statuses/status").OfType<XPathNavigator>()
 							where !status.SelectSingleNode("user/protected").ValueAsBoolean
diff --git a/samples/OAuthConsumerWpf/App.config b/samples/OAuthConsumerWpf/App.config
index f142405..d4d434a 100644
--- a/samples/OAuthConsumerWpf/App.config
+++ b/samples/OAuthConsumerWpf/App.config
@@ -3,7 +3,7 @@
 	<configSections>
 		<section name="uri" type="System.Configuration.UriSection, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
 		<section name="log4net" type="log4net.Config.Log4NetConfigurationSectionHandler" requirePermission="false" />
-		<section name="dotNetOpenAuth" type="DotNetOpenAuth.Configuration.DotNetOpenAuthSection" requirePermission="false" allowLocation="true"/>
+		<section name="dotNetOpenAuth" type="DotNetOpenAuth.Configuration.DotNetOpenAuthSection, DotNetOpenAuth" requirePermission="false" allowLocation="true"/>
 	</configSections>
 
 	<!-- The uri section is necessary to turn on .NET 3.5 support for IDN (international domain names),
diff --git a/samples/OpenIdOfflineProvider/TextBoxTextWriter.cs b/samples/OpenIdOfflineProvider/TextBoxTextWriter.cs
index 8118986..5319a78 100644
--- a/samples/OpenIdOfflineProvider/TextBoxTextWriter.cs
+++ b/samples/OpenIdOfflineProvider/TextBoxTextWriter.cs
@@ -71,7 +71,7 @@ namespace DotNetOpenAuth.OpenIdOfflineProvider {
 		/// Verifies conditions that should be true for any valid state of this object.
 		/// </summary>
 		[ContractInvariantMethod]
-		protected void ObjectInvariant() {
+		private void ObjectInvariant() {
 			Contract.Invariant(this.Box != null);
 		}
 
diff --git a/samples/OpenIdProviderWebForms/ProfileFields.ascx.cs b/samples/OpenIdProviderWebForms/ProfileFields.ascx.cs
index 893830f..6954aa6 100644
--- a/samples/OpenIdProviderWebForms/ProfileFields.ascx.cs
+++ b/samples/OpenIdProviderWebForms/ProfileFields.ascx.cs
@@ -76,15 +76,15 @@ namespace OpenIdProviderWebForms {
 				this.privacyLink.Visible = false;
 			}
 
-			this.dobRequiredLabel.Visible = (requestFields.BirthDate == DemandLevel.Require);
-			this.countryRequiredLabel.Visible = (requestFields.Country == DemandLevel.Require);
-			this.emailRequiredLabel.Visible = (requestFields.Email == DemandLevel.Require);
-			this.fullnameRequiredLabel.Visible = (requestFields.FullName == DemandLevel.Require);
-			this.genderRequiredLabel.Visible = (requestFields.Gender == DemandLevel.Require);
-			this.languageRequiredLabel.Visible = (requestFields.Language == DemandLevel.Require);
-			this.nicknameRequiredLabel.Visible = (requestFields.Nickname == DemandLevel.Require);
-			this.postcodeRequiredLabel.Visible = (requestFields.PostalCode == DemandLevel.Require);
-			this.timezoneRequiredLabel.Visible = (requestFields.TimeZone == DemandLevel.Require);
+			this.dobRequiredLabel.Visible = requestFields.BirthDate == DemandLevel.Require;
+			this.countryRequiredLabel.Visible = requestFields.Country == DemandLevel.Require;
+			this.emailRequiredLabel.Visible = requestFields.Email == DemandLevel.Require;
+			this.fullnameRequiredLabel.Visible = requestFields.FullName == DemandLevel.Require;
+			this.genderRequiredLabel.Visible = requestFields.Gender == DemandLevel.Require;
+			this.languageRequiredLabel.Visible = requestFields.Language == DemandLevel.Require;
+			this.nicknameRequiredLabel.Visible = requestFields.Nickname == DemandLevel.Require;
+			this.postcodeRequiredLabel.Visible = requestFields.PostalCode == DemandLevel.Require;
+			this.timezoneRequiredLabel.Visible = requestFields.TimeZone == DemandLevel.Require;
 
 			this.dateOfBirthRow.Visible = !(requestFields.BirthDate == DemandLevel.NoRequest);
 			this.countryRow.Visible = !(requestFields.Country == DemandLevel.NoRequest);
diff --git a/samples/OpenIdRelyingPartyWebForms/ajaxlogin.aspx.cs b/samples/OpenIdRelyingPartyWebForms/ajaxlogin.aspx.cs
index 78d08f3..f7d44d5 100644
--- a/samples/OpenIdRelyingPartyWebForms/ajaxlogin.aspx.cs
+++ b/samples/OpenIdRelyingPartyWebForms/ajaxlogin.aspx.cs
@@ -18,7 +18,7 @@
 		}
 
 		protected void OpenIdAjaxTextBox1_LoggedIn(object sender, OpenIdEventArgs e) {
-			Label label = ((Label)this.commentSubmitted.FindControl("emailLabel"));
+			Label label = (Label)this.commentSubmitted.FindControl("emailLabel");
 			label.Text = e.Response.FriendlyIdentifierForDisplay;
 
 			// We COULD get the sreg extension response here for the email, but since we let the user
diff --git a/src/DotNetOpenAuth.Test/Messaging/Reflection/MessageDictionaryTests.cs b/src/DotNetOpenAuth.Test/Messaging/Reflection/MessageDictionaryTests.cs
index 24171e1..b9e7436 100644
--- a/src/DotNetOpenAuth.Test/Messaging/Reflection/MessageDictionaryTests.cs
+++ b/src/DotNetOpenAuth.Test/Messaging/Reflection/MessageDictionaryTests.cs
@@ -300,7 +300,7 @@ namespace DotNetOpenAuth.Test.Messaging.Reflection {
 		[TestMethod]
 		public void CopyTo() {
 			ICollection<KeyValuePair<string, string>> target = this.MessageDescriptions.GetAccessor(this.message);
-			IDictionary<string, string> targetAsDictionary = ((IDictionary<string, string>)target);
+			IDictionary<string, string> targetAsDictionary = (IDictionary<string, string>)target;
 			KeyValuePair<string, string>[] array = new KeyValuePair<string, string>[target.Count + 1];
 			int arrayIndex = 1;
 			target.CopyTo(array, arrayIndex);
@@ -317,7 +317,7 @@ namespace DotNetOpenAuth.Test.Messaging.Reflection {
 		[TestMethod]
 		public void ContainsKeyValuePair() {
 			ICollection<KeyValuePair<string, string>> target = this.MessageDescriptions.GetAccessor(this.message);
-			IDictionary<string, string> targetAsDictionary = ((IDictionary<string, string>)target);
+			IDictionary<string, string> targetAsDictionary = (IDictionary<string, string>)target;
 			Assert.IsFalse(target.Contains(new KeyValuePair<string, string>("age", "1")));
 			Assert.IsTrue(target.Contains(new KeyValuePair<string, string>("age", "0")));
 
@@ -333,7 +333,7 @@ namespace DotNetOpenAuth.Test.Messaging.Reflection {
 		[TestMethod]
 		public void ClearValues() {
 			MessageDictionary target = this.MessageDescriptions.GetAccessor(this.message);
-			IDictionary<string, string> targetAsDictionary = ((IDictionary<string, string>)target);
+			IDictionary<string, string> targetAsDictionary = (IDictionary<string, string>)target;
 			this.message.Name = "Andrew";
 			this.message.Age = 15;
 			targetAsDictionary["extra"] = "value";
diff --git a/src/DotNetOpenAuth.Test/OpenId/Extensions/AttributeExchange/AttributeExchangeRoundtripTests.cs b/src/DotNetOpenAuth.Test/OpenId/Extensions/AttributeExchange/AttributeExchangeRoundtripTests.cs
index 1051092..fa05e94 100644
--- a/src/DotNetOpenAuth.Test/OpenId/Extensions/AttributeExchange/AttributeExchangeRoundtripTests.cs
+++ b/src/DotNetOpenAuth.Test/OpenId/Extensions/AttributeExchange/AttributeExchangeRoundtripTests.cs
@@ -34,8 +34,8 @@ namespace DotNetOpenAuth.Test.OpenId.Extensions {
 			var request = new StoreRequest();
 			var newAttribute = new AttributeValues(
 				IncrementingAttribute,
-				"val" + (incrementingAttributeValue++).ToString(),
-				"val" + (incrementingAttributeValue++).ToString());
+				"val" + (this.incrementingAttributeValue++).ToString(),
+				"val" + (this.incrementingAttributeValue++).ToString());
 			request.Attributes.Add(newAttribute);
 
 			var successResponse = new StoreResponse();
diff --git a/src/DotNetOpenAuth.Test/OpenId/RelyingParty/AuthenticationRequestTests.cs b/src/DotNetOpenAuth.Test/OpenId/RelyingParty/AuthenticationRequestTests.cs
index 8f53cdd..332b0b7 100644
--- a/src/DotNetOpenAuth.Test/OpenId/RelyingParty/AuthenticationRequestTests.cs
+++ b/src/DotNetOpenAuth.Test/OpenId/RelyingParty/AuthenticationRequestTests.cs
@@ -113,11 +113,11 @@ namespace DotNetOpenAuth.Test.OpenId.RelyingParty {
 			var rp = CreateRelyingParty();
 
 			// First verify that delegating identifiers work
-			Assert.IsTrue(AuthenticationRequest.Create(id, rp, realm, returnTo, false).Any(), "The delegating identifier should have not generated any results.");
+			Assert.IsTrue(AuthenticationRequest.Create(id, rp, this.realm, this.returnTo, false).Any(), "The delegating identifier should have not generated any results.");
 
 			// Now disable them and try again.
 			rp.SecuritySettings.RejectDelegatingIdentifiers = true;
-			Assert.IsFalse(AuthenticationRequest.Create(id, rp, realm, returnTo, false).Any(), "The delegating identifier should have not generated any results.");
+			Assert.IsFalse(AuthenticationRequest.Create(id, rp, this.realm, this.returnTo, false).Any(), "The delegating identifier should have not generated any results.");
 		}
 
 		/// <summary>
diff --git a/src/DotNetOpenAuth/DotNetOpenAuth.csproj b/src/DotNetOpenAuth/DotNetOpenAuth.csproj
index 053861a..2995374 100644
--- a/src/DotNetOpenAuth/DotNetOpenAuth.csproj
+++ b/src/DotNetOpenAuth/DotNetOpenAuth.csproj
@@ -690,4 +690,11 @@ http://opensource.org/licenses/ms-pl.html
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
   <Import Project="..\..\tools\DotNetOpenAuth.Versioning.targets" />
   <Import Project="..\..\tools\JavascriptPacker.targets" />
-</Project>
\ No newline at end of file
+  <PropertyGroup>
+    <CompileDependsOn>$(CompileDependsOn);CheckForCodeContracts</CompileDependsOn>
+  </PropertyGroup>
+  <Target Name="CheckForCodeContracts">
+      <Error Condition=" '$(CodeContractsImported)' != 'true' "
+             Text="This project requires Code Contracts. Please install from: http://msdn.microsoft.com/en-us/devlabs/dd491992.aspx"/>
+  </Target>
+</Project>
diff --git a/src/DotNetOpenAuth/InfoCard/ReceivedTokenEventArgs.cs b/src/DotNetOpenAuth/InfoCard/ReceivedTokenEventArgs.cs
index 6c6a5af..f325ff9 100644
--- a/src/DotNetOpenAuth/InfoCard/ReceivedTokenEventArgs.cs
+++ b/src/DotNetOpenAuth/InfoCard/ReceivedTokenEventArgs.cs
@@ -34,7 +34,7 @@ namespace DotNetOpenAuth.InfoCard {
 		[SuppressMessage("Microsoft.Performance", "CA1822:MarkMembersAsStatic", Justification = "Called by code contracts.")]
 		[SuppressMessage("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode", Justification = "Called by code contracts.")]
 		[ContractInvariantMethod]
-		protected void ObjectInvariant() {
+		private void ObjectInvariant() {
 			Contract.Invariant(this.Token != null);
 		}
 #endif
diff --git a/src/DotNetOpenAuth/InfoCard/ReceivingTokenEventArgs.cs b/src/DotNetOpenAuth/InfoCard/ReceivingTokenEventArgs.cs
index aaf734b..124f9f8 100644
--- a/src/DotNetOpenAuth/InfoCard/ReceivingTokenEventArgs.cs
+++ b/src/DotNetOpenAuth/InfoCard/ReceivingTokenEventArgs.cs
@@ -84,7 +84,7 @@ namespace DotNetOpenAuth.InfoCard {
 		[SuppressMessage("Microsoft.Performance", "CA1822:MarkMembersAsStatic", Justification = "Called by code contracts.")]
 		[SuppressMessage("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode", Justification = "Called by code contracts.")]
 		[ContractInvariantMethod]
-		protected void ObjectInvariant() {
+		private void ObjectInvariant() {
 			Contract.Invariant(this.TokenXml != null);
 			Contract.Invariant(this.DecryptingTokens != null);
 		}
diff --git a/src/DotNetOpenAuth/InfoCard/Token/Token.cs b/src/DotNetOpenAuth/InfoCard/Token/Token.cs
index 4656e3f..7fa9a95 100644
--- a/src/DotNetOpenAuth/InfoCard/Token/Token.cs
+++ b/src/DotNetOpenAuth/InfoCard/Token/Token.cs
@@ -199,19 +199,6 @@ namespace DotNetOpenAuth.InfoCard {
 			}
 		}
 
-#if CONTRACTS_FULL
-		/// <summary>
-		/// Verifies conditions that should be true for any valid state of this object.
-		/// </summary>
-		[SuppressMessage("Microsoft.Performance", "CA1822:MarkMembersAsStatic", Justification = "Called by code contracts.")]
-		[SuppressMessage("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode", Justification = "Called by code contracts.")]
-		[ContractInvariantMethod]
-		protected void ObjectInvariant()
-		{
-			Contract.Invariant(this.AuthorizationContext != null);
-		}
-#endif
-
 		/// <summary>
 		/// Determines whether the specified token XML is encrypted.
 		/// </summary>
@@ -224,6 +211,18 @@ namespace DotNetOpenAuth.InfoCard {
 			return tokenXmlReader.IsStartElement(TokenDecryptor.XmlEncryptionStrings.EncryptedData, TokenDecryptor.XmlEncryptionStrings.Namespace);
 		}
 
+#if CONTRACTS_FULL
+		/// <summary>
+		/// Verifies conditions that should be true for any valid state of this object.
+		/// </summary>
+		[SuppressMessage("Microsoft.Performance", "CA1822:MarkMembersAsStatic", Justification = "Called by code contracts.")]
+		[SuppressMessage("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode", Justification = "Called by code contracts.")]
+		[ContractInvariantMethod]
+		private void ObjectInvariant() {
+			Contract.Invariant(this.AuthorizationContext != null);
+		}
+#endif
+
 		/// <summary>
 		/// Flattens the claims into a dictionary
 		/// </summary>
diff --git a/src/DotNetOpenAuth/InfoCard/Token/TokenDecryptor.cs b/src/DotNetOpenAuth/InfoCard/Token/TokenDecryptor.cs
index 2257f15..9424480 100644
--- a/src/DotNetOpenAuth/InfoCard/Token/TokenDecryptor.cs
+++ b/src/DotNetOpenAuth/InfoCard/Token/TokenDecryptor.cs
@@ -150,7 +150,7 @@ namespace DotNetOpenAuth.InfoCard {
 		[SuppressMessage("Microsoft.Performance", "CA1822:MarkMembersAsStatic", Justification = "Called by code contracts.")]
 		[SuppressMessage("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode", Justification = "Called by code contracts.")]
 		[ContractInvariantMethod]
-		protected void ObjectInvariant() {
+		private void ObjectInvariant() {
 			Contract.Invariant(this.Tokens != null);
 		}
 #endif
diff --git a/src/DotNetOpenAuth/InfoCard/TokenProcessingErrorEventArgs.cs b/src/DotNetOpenAuth/InfoCard/TokenProcessingErrorEventArgs.cs
index 1b4a62d..0f17b63 100644
--- a/src/DotNetOpenAuth/InfoCard/TokenProcessingErrorEventArgs.cs
+++ b/src/DotNetOpenAuth/InfoCard/TokenProcessingErrorEventArgs.cs
@@ -41,7 +41,7 @@ namespace DotNetOpenAuth.InfoCard {
 		[SuppressMessage("Microsoft.Performance", "CA1822:MarkMembersAsStatic", Justification = "Called by code contracts.")]
 		[SuppressMessage("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode", Justification = "Called by code contracts.")]
 		[ContractInvariantMethod]
-		protected void ObjectInvariant() {
+		private void ObjectInvariant() {
 			Contract.Invariant(this.TokenXml != null);
 			Contract.Invariant(this.Exception != null);
 		}
diff --git a/src/DotNetOpenAuth/Messaging/Channel.cs b/src/DotNetOpenAuth/Messaging/Channel.cs
index 718fac8..ef6486a 100644
--- a/src/DotNetOpenAuth/Messaging/Channel.cs
+++ b/src/DotNetOpenAuth/Messaging/Channel.cs
@@ -1008,18 +1008,6 @@ namespace DotNetOpenAuth.Messaging {
 			this.incomingBindingElements.AddRange(incomingOrder);
 		}
 
-#if CONTRACTS_FULL
-		/// <summary>
-		/// Verifies conditions that should be true for any valid state of this object.
-		/// </summary>
-		[SuppressMessage("Microsoft.Performance", "CA1822:MarkMembersAsStatic", Justification = "Called by code contracts.")]
-		[SuppressMessage("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode", Justification = "Called by code contracts.")]
-		[ContractInvariantMethod]
-		protected void ObjectInvariant() {
-			Contract.Invariant(this.MessageDescriptions != null);
-		}
-#endif
-
 		/// <summary>
 		/// Ensures a consistent and secure set of binding elements and 
 		/// sorts them as necessary for a valid sequence of operations.
@@ -1069,8 +1057,8 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="protection1">The first protection type to compare.</param>
 		/// <param name="protection2">The second protection type to compare.</param>
 		/// <returns>
-		/// -1 if <paramref name="element1"/> should be applied to an outgoing message before <paramref name="element2"/>.
-		/// 1 if <paramref name="element2"/> should be applied to an outgoing message before <paramref name="element1"/>.
+		/// -1 if <paramref name="protection1"/> should be applied to an outgoing message before <paramref name="protection2"/>.
+		/// 1 if <paramref name="protection2"/> should be applied to an outgoing message before <paramref name="protection1"/>.
 		/// 0 if it doesn't matter.
 		/// </returns>
 		private static int BindingElementOutgoingMessageApplicationOrder(MessageProtections protection1, MessageProtections protection2) {
@@ -1080,6 +1068,18 @@ namespace DotNetOpenAuth.Messaging {
 			return -((int)protection1).CompareTo((int)protection2); // descending flag ordinal order
 		}
 
+#if CONTRACTS_FULL
+		/// <summary>
+		/// Verifies conditions that should be true for any valid state of this object.
+		/// </summary>
+		[SuppressMessage("Microsoft.Performance", "CA1822:MarkMembersAsStatic", Justification = "Called by code contracts.")]
+		[SuppressMessage("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode", Justification = "Called by code contracts.")]
+		[ContractInvariantMethod]
+		private void ObjectInvariant() {
+			Contract.Invariant(this.MessageDescriptions != null);
+		}
+#endif
+
 		/// <summary>
 		/// Verifies that all required message parts are initialized to values
 		/// prior to sending the message to a remote party.
diff --git a/src/DotNetOpenAuth/Messaging/EmptyDictionary.cs b/src/DotNetOpenAuth/Messaging/EmptyDictionary.cs
index 062fcf3..caf292a 100644
--- a/src/DotNetOpenAuth/Messaging/EmptyDictionary.cs
+++ b/src/DotNetOpenAuth/Messaging/EmptyDictionary.cs
@@ -198,7 +198,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// -or-
 		/// The number of elements in the source <see cref="T:System.Collections.Generic.ICollection`1"/> is greater than the available space from <paramref name="arrayIndex"/> to the end of the destination <paramref name="array"/>.
 		/// -or-
-		/// Type <paramref name="T"/> cannot be cast automatically to the type of the destination <paramref name="array"/>.
+		/// Type cannot be cast automatically to the type of the destination <paramref name="array"/>.
 		/// </exception>
 		public void CopyTo(KeyValuePair<TKey, TValue>[] array, int arrayIndex) {
 		}
diff --git a/src/DotNetOpenAuth/Messaging/EmptyList.cs b/src/DotNetOpenAuth/Messaging/EmptyList.cs
index 2261684..ba918a4 100644
--- a/src/DotNetOpenAuth/Messaging/EmptyList.cs
+++ b/src/DotNetOpenAuth/Messaging/EmptyList.cs
@@ -159,7 +159,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// -or-
 		/// The number of elements in the source <see cref="T:System.Collections.Generic.ICollection`1"/> is greater than the available space from <paramref name="arrayIndex"/> to the end of the destination <paramref name="array"/>.
 		/// -or-
-		/// Type <paramref name="T"/> cannot be cast automatically to the type of the destination <paramref name="array"/>.
+		/// Type <typeparamref name="T"/> cannot be cast automatically to the type of the destination <paramref name="array"/>.
 		/// </exception>
 		public void CopyTo(T[] array, int arrayIndex) {
 		}
diff --git a/src/DotNetOpenAuth/Messaging/EnumerableCache.cs b/src/DotNetOpenAuth/Messaging/EnumerableCache.cs
index 6639de1..71825bc 100644
--- a/src/DotNetOpenAuth/Messaging/EnumerableCache.cs
+++ b/src/DotNetOpenAuth/Messaging/EnumerableCache.cs
@@ -135,7 +135,7 @@ namespace DotNetOpenAuth.Messaging {
 				private int cachePosition = -1;
 
 				/// <summary>
-				/// Initializes a new instance of the <see cref="EnumerableCache&lt;T&gt;.EnumeratorCache"/> class.
+				/// Initializes a new instance of the <see cref="EnumeratorCache"/> class.
 				/// </summary>
 				/// <param name="parent">The parent cached enumerable whose GetEnumerator method is calling this constructor.</param>
 				internal EnumeratorCache(EnumerableCache<T> parent) {
diff --git a/src/DotNetOpenAuth/Messaging/ErrorUtilities.cs b/src/DotNetOpenAuth/Messaging/ErrorUtilities.cs
index b560fdc..1807f54 100644
--- a/src/DotNetOpenAuth/Messaging/ErrorUtilities.cs
+++ b/src/DotNetOpenAuth/Messaging/ErrorUtilities.cs
@@ -118,7 +118,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// </summary>
 		/// <param name="condition">The condition to check.</param>
 		/// <param name="errorMessage">The message to include in the exception, if created.</param>
-		/// <param name="args">The string formatting arguments for <paramref name="message"/>.</param>
+		/// <param name="args">The string formatting arguments for <paramref name="errorMessage"/>.</param>
 		/// <exception cref="NotSupportedException">Thrown if <paramref name="condition"/> evaluates to <c>false</c>.</exception>
 		[Pure]
 		internal static void VerifySupported(bool condition, string errorMessage, params object[] args) {
@@ -307,13 +307,12 @@ namespace DotNetOpenAuth.Messaging {
 		}
 
 		/// <summary>
-		/// Verifies something about the argument supplied to a method.
+		/// Throws an <see cref="ArgumentException"/>.
 		/// </summary>
 		/// <param name="parameterName">Name of the parameter.</param>
 		/// <param name="message">The message to use in the exception if the condition is false.</param>
 		/// <param name="args">The string formatting arguments, if any.</param>
 		/// <returns>Never returns anything.  It always throws.</returns>
-		/// <exception cref="ArgumentException">Thrown if <paramref name="condition"/> evaluates to <c>false</c>.</exception>
 		[Pure]
 		internal static Exception ThrowArgumentNamed(string parameterName, string message, params object[] args) {
 			Contract.Requires<ArgumentNullException>(args != null);
diff --git a/src/DotNetOpenAuth/Messaging/HttpRequestInfo.cs b/src/DotNetOpenAuth/Messaging/HttpRequestInfo.cs
index 6c7f2f9..94990c8 100644
--- a/src/DotNetOpenAuth/Messaging/HttpRequestInfo.cs
+++ b/src/DotNetOpenAuth/Messaging/HttpRequestInfo.cs
@@ -362,17 +362,6 @@ namespace DotNetOpenAuth.Messaging {
 			return query;
 		}
 
-#if CONTRACTS_FULL
-		/// <summary>
-		/// Verifies conditions that should be true for any valid state of this object.
-		/// </summary>
-		[SuppressMessage("Microsoft.Performance", "CA1822:MarkMembersAsStatic", Justification = "Called by code contracts.")]
-		[SuppressMessage("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode", Justification = "Called by code contracts.")]
-		[ContractInvariantMethod]
-		protected void ObjectInvariant() {
-		}
-#endif
-
 		/// <summary>
 		/// Gets the public facing URL for the given incoming HTTP request.
 		/// </summary>
@@ -417,5 +406,16 @@ namespace DotNetOpenAuth.Messaging {
 
 			return headers;
 		}
+
+#if CONTRACTS_FULL
+		/// <summary>
+		/// Verifies conditions that should be true for any valid state of this object.
+		/// </summary>
+		[SuppressMessage("Microsoft.Performance", "CA1822:MarkMembersAsStatic", Justification = "Called by code contracts.")]
+		[SuppressMessage("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode", Justification = "Called by code contracts.")]
+		[ContractInvariantMethod]
+		private void ObjectInvariant() {
+		}
+#endif
 	}
 }
diff --git a/src/DotNetOpenAuth/Messaging/MessageSerializer.cs b/src/DotNetOpenAuth/Messaging/MessageSerializer.cs
index a21559e..ccda5d5 100644
--- a/src/DotNetOpenAuth/Messaging/MessageSerializer.cs
+++ b/src/DotNetOpenAuth/Messaging/MessageSerializer.cs
@@ -116,7 +116,7 @@ namespace DotNetOpenAuth.Messaging {
 		[SuppressMessage("Microsoft.Performance", "CA1822:MarkMembersAsStatic", Justification = "Called by code contracts.")]
 		[SuppressMessage("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode", Justification = "Called by code contracts.")]
 		[ContractInvariantMethod]
-		protected void ObjectInvariant() {
+		private void ObjectInvariant() {
 			Contract.Invariant(this.messageType != null);
 		}
 #endif
diff --git a/src/DotNetOpenAuth/Messaging/MultipartPostPart.cs b/src/DotNetOpenAuth/Messaging/MultipartPostPart.cs
index 9cbf11b..7ef89a4 100644
--- a/src/DotNetOpenAuth/Messaging/MultipartPostPart.cs
+++ b/src/DotNetOpenAuth/Messaging/MultipartPostPart.cs
@@ -192,7 +192,7 @@ namespace DotNetOpenAuth.Messaging {
 		/// </summary>
 		[SuppressMessage("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode", Justification = "Called by code contracts.")]
 		[ContractInvariantMethod]
-		protected void Invariant() {
+		private void Invariant() {
 			Contract.Invariant(!string.IsNullOrEmpty(this.ContentDisposition));
 			Contract.Invariant(this.PartHeaders != null);
 			Contract.Invariant(this.ContentAttributes != null);
diff --git a/src/DotNetOpenAuth/Messaging/Reflection/MessageDescription.cs b/src/DotNetOpenAuth/Messaging/Reflection/MessageDescription.cs
index 738c2a3..5493ba6 100644
--- a/src/DotNetOpenAuth/Messaging/Reflection/MessageDescription.cs
+++ b/src/DotNetOpenAuth/Messaging/Reflection/MessageDescription.cs
@@ -128,7 +128,7 @@ namespace DotNetOpenAuth.Messaging.Reflection {
 		/// <param name="keys">The names of all parameters included in a message.</param>
 		/// <exception cref="ProtocolException">Thrown when required parts of a message are not in <paramref name="keys"/></exception>
 		private void EnsureRequiredMessagePartsArePresent(IEnumerable<string> keys) {
-			var missingKeys = (from part in Mapping.Values
+			var missingKeys = (from part in this.Mapping.Values
 							   where part.IsRequired && !keys.Contains(part.Name)
 							   select part.Name).ToArray();
 			if (missingKeys.Length > 0) {
@@ -147,7 +147,7 @@ namespace DotNetOpenAuth.Messaging.Reflection {
 		/// <param name="partValues">A dictionary of key/value pairs that make up the serialized message.</param>
 		private void EnsureRequiredProtocolMessagePartsAreNotEmpty(IDictionary<string, string> partValues) {
 			string value;
-			var emptyValuedKeys = (from part in Mapping.Values
+			var emptyValuedKeys = (from part in this.Mapping.Values
 								   where !part.AllowEmpty && partValues.TryGetValue(part.Name, out value) && value != null && value.Length == 0
 								   select part.Name).ToArray();
 			if (emptyValuedKeys.Length > 0) {
diff --git a/src/DotNetOpenAuth/Messaging/Reflection/MessageDictionary.cs b/src/DotNetOpenAuth/Messaging/Reflection/MessageDictionary.cs
index fedc136..49e30cb 100644
--- a/src/DotNetOpenAuth/Messaging/Reflection/MessageDictionary.cs
+++ b/src/DotNetOpenAuth/Messaging/Reflection/MessageDictionary.cs
@@ -393,7 +393,7 @@ namespace DotNetOpenAuth.Messaging.Reflection {
 		[SuppressMessage("Microsoft.Performance", "CA1822:MarkMembersAsStatic", Justification = "Called by code contracts.")]
 		[SuppressMessage("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode", Justification = "Called by code contracts.")]
 		[ContractInvariantMethod]
-		protected void ObjectInvariant() {
+		private void ObjectInvariant() {
 			Contract.Invariant(this.Message != null);
 			Contract.Invariant(this.Description != null);
 		}
diff --git a/src/DotNetOpenAuth/OpenId/Association.cs b/src/DotNetOpenAuth/OpenId/Association.cs
index 311ba58..62e91ec 100644
--- a/src/DotNetOpenAuth/OpenId/Association.cs
+++ b/src/DotNetOpenAuth/OpenId/Association.cs
@@ -290,7 +290,7 @@ namespace DotNetOpenAuth.OpenId {
 		[SuppressMessage("Microsoft.Performance", "CA1822:MarkMembersAsStatic", Justification = "Called by code contracts.")]
 		[SuppressMessage("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode", Justification = "Called by code contracts.")]
 		[ContractInvariantMethod]
-		protected void ObjectInvariant() {
+		private void ObjectInvariant() {
 			Contract.Invariant(!string.IsNullOrEmpty(this.Handle));
 			Contract.Invariant(this.TotalLifeLength > TimeSpan.Zero);
 			Contract.Invariant(this.SecretKey != null);
diff --git a/src/DotNetOpenAuth/OpenId/Associations.cs b/src/DotNetOpenAuth/OpenId/Associations.cs
index 4fd89c4..cf49d1c 100644
--- a/src/DotNetOpenAuth/OpenId/Associations.cs
+++ b/src/DotNetOpenAuth/OpenId/Associations.cs
@@ -119,7 +119,7 @@ namespace DotNetOpenAuth.OpenId {
 		[SuppressMessage("Microsoft.Performance", "CA1822:MarkMembersAsStatic", Justification = "Called by code contracts.")]
 		[SuppressMessage("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode", Justification = "Called by code contracts.")]
 		[ContractInvariantMethod]
-		protected void ObjectInvariant() {
+		private void ObjectInvariant() {
 			Contract.Invariant(this.associations != null);
 		}
 #endif
diff --git a/src/DotNetOpenAuth/OpenId/DiffieHellman/DiffieHellmanManaged.cs b/src/DotNetOpenAuth/OpenId/DiffieHellman/DiffieHellmanManaged.cs
index 2535b0f..75787c3 100644
--- a/src/DotNetOpenAuth/OpenId/DiffieHellman/DiffieHellmanManaged.cs
+++ b/src/DotNetOpenAuth/OpenId/DiffieHellman/DiffieHellmanManaged.cs
@@ -162,7 +162,7 @@ namespace Org.Mentalis.Security.Cryptography {
 		/// Imports the specified <see cref="DHParameters"/>.
 		/// </summary>
 		/// <param name="parameters">The parameters for <see cref="DiffieHellman"/>.</param>
-		/// <exception cref="CryptographicException"><paramref name="P"/> or <paramref name="G"/> is a null reference (<b>Nothing</b> in Visual Basic) -or- <paramref name="P"/> is not a prime number.</exception>
+		/// <exception cref="CryptographicException"><see cref="DHParameters.P">parameters.P</see> or <see cref="DHParameters.G">parameters.G</see> is a null reference (<b>Nothing</b> in Visual Basic) -or- <see cref="DHParameters.P">parameters.P</see> is not a prime number.</exception>
 		public override void ImportParameters(DHParameters parameters) {
 			if (parameters.P == null)
 				throw new CryptographicException("Missing P value.");
diff --git a/src/DotNetOpenAuth/OpenId/Extensions/ExtensionsInteropHelper.cs b/src/DotNetOpenAuth/OpenId/Extensions/ExtensionsInteropHelper.cs
index 9b166e3..9e7ccd2 100644
--- a/src/DotNetOpenAuth/OpenId/Extensions/ExtensionsInteropHelper.cs
+++ b/src/DotNetOpenAuth/OpenId/Extensions/ExtensionsInteropHelper.cs
@@ -35,7 +35,7 @@ namespace DotNetOpenAuth.OpenId.Extensions {
 		/// <remarks>
 		/// 	<para>If discovery on the user-supplied identifier yields hints regarding which
 		/// extensions and attribute formats the Provider supports, this method MAY ignore the
-		/// <paramref name="attributeFormat"/> argument and accomodate the Provider to minimize
+		/// <paramref name="attributeFormats"/> argument and accomodate the Provider to minimize
 		/// the size of the request.</para>
 		/// 	<para>If the request does not carry an sreg extension, the method logs a warning but
 		/// otherwise quietly returns doing nothing.</para>
diff --git a/src/DotNetOpenAuth/OpenId/Provider/PrivatePersonalIdentifierProviderBase.cs b/src/DotNetOpenAuth/OpenId/Provider/PrivatePersonalIdentifierProviderBase.cs
index 260fc85..46e172c 100644
--- a/src/DotNetOpenAuth/OpenId/Provider/PrivatePersonalIdentifierProviderBase.cs
+++ b/src/DotNetOpenAuth/OpenId/Provider/PrivatePersonalIdentifierProviderBase.cs
@@ -213,7 +213,7 @@ namespace DotNetOpenAuth.OpenId.Provider {
 		/// </summary>
 		[SuppressMessage("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode", Justification = "Called by code contracts.")]
 		[ContractInvariantMethod]
-		protected void ObjectInvariant() {
+		private void ObjectInvariant() {
 			Contract.Invariant(this.Hasher != null);
 			Contract.Invariant(this.Encoder != null);
 			Contract.Invariant(this.BaseIdentifier != null);
diff --git a/src/DotNetOpenAuth/OpenId/Realm.cs b/src/DotNetOpenAuth/OpenId/Realm.cs
index fb0fbfb..600e6c0 100644
--- a/src/DotNetOpenAuth/OpenId/Realm.cs
+++ b/src/DotNetOpenAuth/OpenId/Realm.cs
@@ -418,18 +418,6 @@ namespace DotNetOpenAuth.OpenId {
 			return null;
 		}
 
-#if CONTRACTS_FULL
-		/// <summary>
-		/// Verifies conditions that should be true for any valid state of this object.
-		/// </summary>
-		[SuppressMessage("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode", Justification = "Called by code contracts.")]
-		[ContractInvariantMethod]
-		protected void ObjectInvariant() {
-			Contract.Invariant(this.uri != null);
-			Contract.Invariant(this.uri.AbsoluteUri != null);
-		}
-#endif
-
 		/// <summary>
 		/// Calls <see cref="UriBuilder.ToString"/> if the argument is non-null.
 		/// Otherwise throws <see cref="ArgumentNullException"/>.
@@ -450,5 +438,17 @@ namespace DotNetOpenAuth.OpenId {
 			// is safe: http://blog.nerdbank.net/2008/04/uriabsoluteuri-and-uritostring-are-not.html
 			return realmUriBuilder.ToString();
 		}
+
+#if CONTRACTS_FULL
+		/// <summary>
+		/// Verifies conditions that should be true for any valid state of this object.
+		/// </summary>
+		[SuppressMessage("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode", Justification = "Called by code contracts.")]
+		[ContractInvariantMethod]
+		private void ObjectInvariant() {
+			Contract.Invariant(this.uri != null);
+			Contract.Invariant(this.uri.AbsoluteUri != null);
+		}
+#endif
 	}
 }
diff --git a/src/DotNetOpenAuth/OpenId/RelyingParty/OpenIdRelyingPartyControlBase.cs b/src/DotNetOpenAuth/OpenId/RelyingParty/OpenIdRelyingPartyControlBase.cs
index cb50fa6..a4a60d1 100644
--- a/src/DotNetOpenAuth/OpenId/RelyingParty/OpenIdRelyingPartyControlBase.cs
+++ b/src/DotNetOpenAuth/OpenId/RelyingParty/OpenIdRelyingPartyControlBase.cs
@@ -954,11 +954,10 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 					req.AddExtension(extension);
 				}
 
-				// Add state that needs to survive across the redirect.
-				if (!this.Stateless) {
-					req.SetUntrustedCallbackArgument(UsePersistentCookieCallbackKey, this.UsePersistentCookie.ToString());
-					req.SetUntrustedCallbackArgument(ReturnToReceivingControlId, this.ClientID);
-				}
+				// Add state that needs to survive across the redirect, but at this point
+				// only save those properties that are not expected to be changed by a
+				// LoggingIn event handler.
+				req.SetUntrustedCallbackArgument(ReturnToReceivingControlId, this.ClientID);
 
 				// Apply the control's association preference to this auth request, but only if
 				// it is less demanding (greater ordinal value) than the existing one.
@@ -969,6 +968,10 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 				}
 
 				if (this.OnLoggingIn(req)) {
+					// We save this property after firing OnLoggingIn so that the host page can
+					// change its value and have that value saved.
+					req.SetUntrustedCallbackArgument(UsePersistentCookieCallbackKey, this.UsePersistentCookie.ToString());
+
 					yield return req;
 				}
 			}
@@ -1054,8 +1057,8 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 			/// <summary>
 			/// Determines whether the specified objects are equal.
 			/// </summary>
-			/// <param name="x">The first object of type <paramref name="T"/> to compare.</param>
-			/// <param name="y">The second object of type <paramref name="T"/> to compare.</param>
+			/// <param name="x">The first object to compare.</param>
+			/// <param name="y">The second object to compare.</param>
 			/// <returns>
 			/// true if the specified objects are equal; otherwise, false.
 			/// </returns>