OpenID Permission Failures obfuscated and not displayed

[danfunk]

OpenID authentications failure with Okta doesn't present a very nice screen. Just a json error message about a missing code.

When Okta is used as the OpenID proider, and the user is found, but does not have permissions to access the system, it returns the following information to the login_return endpoint:

https://[SERVER]/api/v1.0/login_return?state=[snip]&error=access_denied&error_description=User+is+not+assigned+to+the+client+application.

Would be nice to grab this error and description and display it nicely somehow.