IdPSession Validity

[Cantor, Scott]

> In general, if the PRC contains a SessionContext with a non-null IdPSession, is
> it safe to assume that it is valid? IOW, something else has already called
> checkAddress() and checkTimeout()?

I can only speak to what PopulateSessionContext does in the context of the authentication flow, and yes, that action does both.

I think this is in the category of that whole "what does the state of the tree mean wrt to authentication state" issue that's in Jira, we need to tighten up the guidance to make sure we don't violate any assumptions, but it's tricky to know how to document this.

-- Scott