fix(session): keep old access token on failed store, cap incoming path, fold proto case

SetAccessToken cleared the old token before it found that no request
was available for the chunk cookies. The old token was lost.
The stored post-login path had no length bound and could bloat every
later Cookie header. It is now capped at 2048 bytes.
DetermineScheme compared X-Forwarded-Proto case-sensitively while the
cookie code did not, so HTTPS gave an http redirect_uri.

session_access_token_nilrequest_test.go

@@ -0,0 +1,36 @@
+package traefikoidc
+
+import (
+	"crypto/rand"
+	"encoding/base64"
+	"net/http/httptest"
+	"testing"
+)
+
+// A chunked store that cannot run (no request to bind chunk cookies to) must
+// leave the previous access token intact.
+func TestSetAccessTokenNilRequestKeepsOldToken(t *testing.T) {
+	sm, err := NewSessionManager("test-encryption-key-32-characters", false, "", "", 0, NewLogger("error"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	sess, err := sm.GetSession(httptest.NewRequest("GET", "/", nil))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(sess.returnToPoolSafely)
+
+	const old = "smallaccesstokenvaluevaluevalue"
+	sess.SetAccessToken(old)
+
+	blob := make([]byte, 3000)
+	if _, err := rand.Read(blob); err != nil {
+		t.Fatal(err)
+	}
+	sess.request = nil
+	sess.SetAccessToken(base64.StdEncoding.EncodeToString(blob))
+
+	if got := sess.GetAccessToken(); got != old {
+		t.Fatalf("old access token lost after a failed chunked store: %q", got)
+	}
+}