fixup

- do not attempt transition on re-auth
- add confirmAccept handler
- clear credentials from controller after auth
Only allow login as previously logged in user.