"Replay detected of message" causes

[Nate Klingenstein]

> There's no way that's what's happening unless somebody's sitting on a hung browser for 5 minutes or more, and nobody would do that.

I have no idea what these people are doing or not doing, but I think
this is totally plausible on a network with high latency, intermittent
availability, mystery clients, and browsers that remember URLs.  It's
sporadic, as mentioned, so I'll press the affected users for more
details on exactly when they're experiencing this.

I suspected it's mostly "I opened up my phone and it <re>played an old
AuthnRequest and look: error here.  No error over there.  Switch to no
error please."

Anyway, it's back to the drawing board here.  Thanks for all the
insight and I appreciate the magnitude of the challenge.