maciej-jarosiewicz-kaluza

Could this behaviour at least be explicitly mentioned [in the documentation](https://docs.aws.amazon.com/appsync/latest/devguide/security-authz.html#openid-connect-authorization) until it gets resolved? That'd save hours of confusion for many developers trying to make their API calls work.