TODO note on possible deferred promise issue in openid