AuthenticationContext persistence

[Klingenstein, Nate]

> All it is is a copy of authentication that runs any time no IdPSession exists. It lets you do a password step, lookup user data, and then do things based on the user, or if there's already an IdPSession, it skips ahead to the "lookup user data and then do things" step since it already knows who the user is.

For the first time today, it all makes sense conceptually.  Thanks.

If anyone's still here, the implementation is really elegantly factored, but there are a ton of branch points and the context is very important, so you can't really look at any one piece of it in vacuo and have it make sense.

There are two things that keep confusing me:

A)  Recycled names.  Let's just call everything metadata and move on.
B)  State.  Because state is persisted in a variety of ways, including pure client-side, you can't really assume that the entry point makes any sense.  I definitely don't understand this deeply yet.

A lot of the checks that seem pointless become very relevant when clients and back buttons are added into the mix, and a lot of the points that seem really internal are really external.  Is there a clean marker for "possible re-entry point here"?