require authenticated users to sign in again when authorization parameters include "prompt=login", per OIDC Core Spec Sections 3.1.2.1 and 15.1