oidc.removetokens now removes all tokens issued to the user, not just the one that was used for request