The verify_discovery_results method call was moved after the check_signature method call to address a security vulnerability (issue #121). Apparently, the check_signature method relied on the endpoint instance variable being defined by the verify_discovery_results method. As a result, the check_signature method always fails because the server_url is nil.

This fix initializes the endpoint variable within the check_signature method and populates it with the server url passed by the OPENID2 client.

Note: I followed the link for instructions on contributing, but I could not find any instructions on the target site. So I used what the other contributors did as a guide.