OIDC 0.9 extension

[Jim Fox]

Using setting acrRequestAlwaysEssential="true" to OIDC.SSO gives me the 
MFA flow I want and *does* return the acr claim.  Good so far.  However.

The requested principal that I look for in my MFA script is an

     AuthnContextClassRefPrincipal{authnContextClassRef=https://refeds.org/profile/mfa}

and that's what I see in SAML logins.  However, with the OIDC login the requested principal is

     AuthenticationContextClassReferencePrincipal{authnContextClassReference=https://refeds.org/profile/mfa}

They look a lot the same but aren't, really.

Jim