add OIDCReturn401 configuration primitive, closes #41