correct and clarify OIDC_NO_DEFAULT_URL_ON_STATE_TIMEOUT env var usage
# has been provided. The user is also redirected to this URL in case an invalid authorization
# response was received.
#
-# By default there's an exception for handling expired state cookies, in which case an HTML error
-# document is sent to the browser explaining what happened. To override the latter behaviour, so
-# that the browser is also redirected to the OIDCDefaultURL, use:
+# By default, when no OIDCDefaultURL is set, an expired state cookie will lead to an HTML error page
+# being sent to the browser explaining what happened. To copy that (legacy) behaviour when OIDCDefaultURL is set,
+# so that the browser is no longer redirected to the OIDCDefaultURL in case of state cookie expiry, use:
# SetEnvIfExpr true OIDC_NO_DEFAULT_URL_ON_STATE_TIMEOUT=true
#
# The default is to not redirect the browser to any URL but return an HTTP/HTML error to the user.
