mitigating the effects of forceAuthn terrorism

[Scott Cantor]

ForceAuthn doesn't "downgrade" anything, nor does it "destroy" any existing results or "do local SLO" in this code, though I suspect in most implementations it might.

> The end result is awkward where the user re-authenticates with a weak/vulnerable mechanism and his global session gets downgraded to that mechanism as well.

That's not what it does, so far as I know.

> At least conceptually I don't see why an authn request with forceAuthn would have to effectively do local SLO at the same time.

Avoiding that requires a massive amount of work, and I did the work. Most implementers would never bother.

-- Scott