revoking consent when proxying auth to other IDP

[Cantor, Scott]

>...but for the solution I sketched, you wouldn't need anything more than
> just a cookie setter, would you?

Setting  a cookie doesn't do anything on its own. The act of checking that box on the login form just acts a signal to the consent flow itself to clear the record. The prefs page has no relevance there because the consent flow isn't running after it. It's not in fact even a cookie IIRC, it's an internal subcontext that we create as a signal in response to checking the box.

There's no "logic" behind the prefs page, it's just a bit of Javascript that messes with cookies, nothing happens "afterward".

Of course, one *could* change the consent flow itself to look for a cookie, act on it, and then clear the cookie. But that's not what it currently does (or will do in short order since 5.0 is about to ship).

-- Scott