OpenID Session Management Best Practices