Thanks for the tip. I will make your suggested changes. But I will keep the redirect to avoid problems with the ‘realm’.

There shouldn’t be a need to store what the OpenID the user typed in in your Session state. Instead, you should be looking at the IAuthenticationResponse’s ClaimedIdentifier and FriendlyIdentifierForDisplay properties and using those when the user logs in.
In general, you should never store the text value the user typed in because doing so introduces several security problems that could allow attackers to spoof identity of your users.

I would hope that would solve your www vs. no-www problem as well.