so I'm scrubbing `_experimental_forceAuthentication` (param provided by RP) to `forceAuthentication` for internal use.