add option to force re-login for oauth, fixes CAT-68

test plan:
- login to canvas
- do an oauth login from an external app, or with a manual GET request
  according to Step 1 of the "Web Application Flow" at
  https://canvas.instructure.com/doc/api/file.oauth.html,
  and make sure you include the query param force_login=1
- verify that canvas sends you to /login
- verify that without the param force_login=1, canvas still sends you
  directly to /login/oauth2/confirm

Change-Id: I49cd43cc48edf46f192221f5cf8707ee00e0bd8a
Reviewed-on: https://gerrit.instructure.com/32988
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Jeff Belser <jbelser@instructure.com>
Reviewed-by: Nick Houle <nhoule@instructure.com>
Reviewed-by: Jon Jensen <jon@instructure.com>
Product-Review: Marc LeGendre <marc@instructure.com>
QA-Review: Marc LeGendre <marc@instructure.com>