I can echo this comment. Protecting websites with lua-resty-openidc was very easy and required no changes to the actual application code.