In the new flow, we first check if the access and ID tokens are set. If so, we check if the GU_SO cookie was set after the access token's iat claim, which means that the user signed out after they generated these tokens. In this case, we follow the signout behaviour. Otherwise, we handle the subsequent cases (IDAPI cookies are/aren't set). If the GU_SO cookie was set before the iat claim, we can safely ignore it, and continue the flow as above.