* Restore the .oidcCallback route (partially reverts #3461) for external authentication.
* Make sure OIDC also works for non-http URLs.
* Remove oidcAuthentication from the state machine.
There isn't a reliable way to detect failure/cancellation when e.g. the user returns from an external app without interacting with the MAS page.
e989463d91