use freshness session parameter to indicate that the user just authenticated, valid once only...
introduce forceAuthn method instead of parameter to authenticate(), update README