Fix SAML/OIDC with upgrade

See #2044 (closed), CAS was not affected because it uses a special callback URL during upgrade (/upgradesession)