OIDC login dropped organization_id before the provider redirect, so callbacks with an existing matching root session never created an org child session. Persist organization_id in OIDC state, open the child session on callback, and forward the parameter from the sign-in UI. Signed-off-by: Bryan Frimin <bryan@probo.com>