custom auth flow fails subject canonicalization and indicates deeper issue

[Cantor, Scott]

> I am obviously missing something fundamental if two
> invocations of the flow by different users result in two
> instances of MyPrincipal ending up somehow co-mingled.

Haven't reviewed in detail yet, but this generally points to one of two things:

- caching something somewhere
- mislabeling a bean in a flow as singleton (or unmarked) instead of prototype scope

-- Scott