Separating multiple authn methods on SP

[Christopher Bongaarts]

Suppose not-so-hypothetically that I have an SP with the following URLs 
(all under the same vhost, running on Apache):

/foo
/foo/bar
/baz
/quux

/foo/bar and /quux both require AuthnContext of "SuperToken".  Other 
stuff under /foo and /baz do not care what your AuthnContext is.

With the naive configuration (simply using "require AuthnContextClassRef 
SuperToken for /foo/bar and /quux), users who log in using some other 
method than SuperToken to /baz first will get Access Denied to /quux, 
with no way to log in again with SuperToken to get in, since all URLs 
are sharing the same Session.

What is the simplest way to get that "upgrade" functionality to work? 
It seems like having separate ApplicationOverrides for the SuperToken 
URLs should do the trick, but will the handler URL get in the way of 
sharing a common application for /foo/bar and /quux?
-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%