Prerequisite for doing the same to OAuth2 state. This is required for implementing missing OIDC features later.
