[user_oidc] Stored XSS via Authorization Endpoint – Safari-Only