IDP-616

[Cantor, Scott]

The more I dig into this, the more I think this just really shouldn't be 
the job of the consent flows to deal with. I'm sure we could beat it into 
submission, but I think it's better if this is addressed somehow in the 
storage layer even if it ends up being a layer violation. Sometimes that's 
just the cost of hiding stuff from the application layer.

We have the freedom to add some APIs for this release, so I'd much rather 
fix it once and potentially address other use cases than try and do this 
for one use case.

We still may need a counter for frequency, etc., but that's really its own 
problem.

If I have until Monday at least, I can give it a try.

-- Scott