Add missin acceptance specs for existing user flow
Implement flag to remotely sign out user.

This only implements the auth flow part of this, forcing a re-auth if
the flag is set.  Implementing the callback endpoint to actually set
this flag will follow later.