show error if authorization failed (403 Forbidden)
use loggedInUser to prevent infinite redirect when auth'd but not authz'd
processAssertion now returns identityIssuer
cookie and request now include issuer, and require logic checks it