Fixes #125 - Avoid double-prompting on initial login

Previously if prompt=login was passed for the authorize request and the
end user was not currently authenticated with IdSrv3 they would be asked
for a username and password, twice, before being redirected back to the
client.

Now they will only be challenged once, in both the 'user is currently
authenticated' and the 'user is not current authenticated' cases.