Support for WS-federation freshness

In order to support freshness requirements on requests where the user
does not have a session we need to stop using the ClaimsAuthorize
attribute and instead perform the authorization check ourselves so that
if needed we redirect to the login page removing the freshness
requirement