extend remoteuser flow?

[Cantor, Scott]

> The remoteuser authn flow redirects to a configured location where,
> by external mechanism, the user's id can be obtained from REMOTE_USER.
> A simple extension of this flow would allow it to support passive,
> forced authn, and maybe token.

It could, but as I tried to document a bit, my feeling was that at that point, External is the right flow to use, because the use of REMOTE_USER is really a trivial specialization of that flow. It's just meant to address backward compatibility for that simple use case.

-- Scott