[keycloak-user] ResponseLocation in SAML identity broker