change(openid-connect): when bearer_only is false, require the user to fill in session.secret

change(openid-connect): when bearer_only is false, require the user to fill in session.secret #990