The description of the pram roles feels ambiguous. Make it clear that the user should belong to one of the roles and not all of them.
As documented: https://docs.microsoft.com/en-us/aspnet/core/security/authorization/roles?view=aspnetcore-2.1

… indicate usage. (aspnet#1908)

Change description of role in RequireRole method

…pnet#1887)

* Add AccessDeniedPath support to the OIDC/OAuth2/Twitter providers

* Update the code documentation and remove an unnecessary call to SignOutAsync()

* Introduce a new AccessDenied event and move most of the access denied handling logic to RemoteAuthenticationHandler

* Add ReturnUrlParameter support to RemoteAuthenticationHandler

* Remove AccessDeniedException and introduce RemoteAuthenticationHandler.HandleAccessDeniedErrorAsync()

* Use OriginalPath instead of Request.Path

* Update obsolete code comments

* Add unit tests for the new AccessDenied event

* Allow customizing the access denied path/return URL/return URL parameter from the AccessDenied event

Changes:

* Upgrade dependencies and build tools
* Change TFM on Microsoft.AspNetCore.* packages to netcoreapp3.0
* Remove .NET Framework tests
* Disable Owin interop tests. They need to be completely refactored