ACS does not specify expiration, transport-security, or anti-clickjacking headers as other OpenID, or SAML providers such as ADFSv2 do. Please implement these security features:

http://social.msdn.microsoft.com/Forums/en-US/windowsazuresecurity/thread/eab4b53e-438b-4b20-8933-ae88e2f3610f

See a detailed list of headers here:

http://security.stackexchange.com/q/8480/396