PP/TOS requirements are different from auto reauthentication #626

Currently the spec makes it sound like these two are the same, but they are not. PP/TOS may not be shown if the IdP requests it, whereas auto reauthentication may only occur if the browser knows that this account was previously used.