hint about openid timeouts