fix: accidental unnecessarily strict conditional that effectively rendered SSO state checking opt-in instead of opt-out

src/routes/authentication.js

@@ -104,7 +104,7 @@ Auth.reloadRoutes = async function (params) {
 					prompt: strategy.prompt || undefined,
 				};
 
-				if (strategy.checkState) {
+				if (strategy.checkState !== false) {
 					req.session.ssoState = req.csrfToken && req.csrfToken();
 					opts.state = req.session.ssoState;
 				}