New TODO: upgrade to OpenID Connect. OpenID 2.0 is dying :(