Fixed by adding CORS support to the endpoints meant to be called directly by JavaScript clients (userinfo, token, JWK set and discovery), as recommended for the userinfo endpoint by OpenID Connect Core 1.0, section 5.3:
preflight (OPTIONS) requests are answered with a 204 and the CORS headers
Access-Control-Allow-Credentials is never sent, so the browser never sends the XWiki session cookie in a cross origin call
the allowed origins can be configured with the oidc.provider.cors.allowedOrigins property in xwiki.properties (any origin by default, an empty list disables CORS)
an unsupported HTTP method now produces a 405 error instead of a 500 error
