excludeSessionStateFromAuthResponse