Authentication using the OpenID Connect authorization code flow - comments