some comments about v3 post-login / post-authn flows

[Tom Zeller]

> If it weren't silly, we could have a callout at every step, the flows
> don't care.

Well, being silly sometimes, I was thinking that "extension" flows,
perhaps consent or ToU, could listen for event IDs and then execute
themselves. So, rather than wiring in post-authn or pre-authn
callouts, a flow would be configured with the event IDs that it cares
about. I looked a little at Web Flow's FlowExecutionListener
interface, but did not see a way to "dynamically" configure flows. The
point being that someone writing a flow could inject it into a system
flow without modifying anything in system/, but I don't think this is
really something we were trying to do, just a thought.