Simplify WithReauth() and its dependency workflow.

This change also threads the desired AccessProvider to the reauth
handler, so the reauth handler doesn't have to fish it out through some
hard to maintain back-channel.