OIDC auth flow should recover gracefully from 'bad auth token' error

[mairas]

Problem

When using OIDC authentication, users can encounter a "bad auth token" error state that prevents login. Currently, the only workaround is for users to manually clear their browser cookies.

Expected Behavior

The server should detect invalid or expired auth tokens and recover gracefully by:

• Clearing the invalid token/session automatically
• Redirecting the user to restart the authentication flow
• Providing a clear error message explaining what happened

Current Behavior

Users get stuck in an error state and must manually clear cookies to recover, which is not user-friendly and difficult to diagnose.

Suggested Solution

1. When detecting a bad/expired auth token, invalidate the session server-side
2. Clear the problematic cookie(s) in the response
3. Redirect to the login page or OIDC provider to restart authentication
4. Optionally, display a user-friendly message like "Your session expired, please log in again"

Additional Context

This issue affects user experience, especially for less technical users who may not know how to clear browser cookies or identify which cookies to clear.