CSRF protection on OIDC login is broken