Security: login open redirect and OIDC callback fixes