Identity 2 JWT, Sessions and Account Recovery Sep 20, 2026 OAuth, OIDC and SAML: Where Federated Trust Breaks Sep 20, 2026