Prevent recontext, except in CernVM Online

Override is possible with --force