SP's Login session initiator settings and access control

[Michael A Grady]

Is there a way I'm missing to "lock down" any of the /Login session initiator settings? By that I mean not be able to override the defaults (say if one set forceAuthn as a default) by directly going to the /Login endpoint with a query string parameter? I.e. what would keep a clueful user from avoiding forceAuthn by just pre-establishing their SP session with /Login?forceAuthn=false ? (Of course, they could do the the same with requested authn context etc.) 

Or, as I suspect, if an app really cares, it comes down to the app checking Authn Instant, authn context, etc.? Of course, with authnContext, one could add an AccessControl check for that, but is there any form of AccessControl one could do on forceAuthn/Authn Instant?  (For that matter, can the custom SP variables like Shib-Identity-Provider be referenced in AccessControl?  Or only those with a predefined alias like authnContextClassRef?)

--
Michael A. Grady
IAM Architect, Unicon, Inc.