fantastic.  so the implementor can supply an ErrorDocument directive which explains to the user why things didn't work.

The only tiny improvement I can think of here is to pass the email used to the error document (via a header?) so that the error document can use this to explain what went wrong more clearly.  

So "you logged in with lloyd@hilaiel.com, but for this site you must use a @mozilla.com or @mozillafoundation.org email address".

Shouldn't block the merge, because we may choose to lock to issuer which makes this problem go away for our first use case.