[CXF-6157] Support storing of OAuth2 redirection state in a session token