Revalidate == PUT /session == what-the-auth-filter-does == TermsOfUseException iff the user hasn't accepted the terms.
Revalidate is used because it explicitly throws a ToUException.  All other methods would just throw a 403.