auth_time is now tracked, addresses #288
test for max_age, force login if not fresh enough, addresses #467
added prompt=login support, addresses #323