Redirect to SSO when ticket is invalid

We saw some occurrences of `RackCAS::ServiceValidationResponse::AuthenticationFailure` with failure message "Ticket 'ST-1368175095-2n1213vkujosbwu0qqngmbjqxb3fwsz5cy3k375s' already consumed".

When an invalid ticket is presented, rack-cas should redirect to the SSO to get a new service ticket. This is exactly what this PR does.