Eperez force authn 181

[EDUID-181](https://project.nordu.net/browse/EDUID-181): perform forceAuthn when changing password and terminating account
I'm not 100% sure so I would like to ask, is there any security implications if someone spoofs the HTTP_REFERER? Can I get past the force-authn requirement by setting my HTTP_REFERER to the ACS path or something here?

I think it looks like the only thing I could manage by spoofing the referer is to be forced to authn again and again, but I just wanted to check with you.