intercept flow detect first authentication

[Cantor, Scott]

> What is the most elegant way for a post-authentication
> intercept flow to only "fire" after the first authentication
> and not as part of any future SSO flows?

I'm not sure there's an elegant way, and my brain's inside the SP right this second, but I think you could check to see if AuthenticationContext.getAuthenticationResult() is contained within AuthenticationContext.getActiveResults().valueSet()

I overrode AuthenticationResult.equals() so that equality is based on the flow ID and the authentication timestamp, so that should guarantee it's the same act.

-- Scott