rejig SAML/OpenID connect stuff