oidc.check() functionality does not check session anymore, only validity of the provided access token