-RM-3711-MR-Force re-authentication

Support forcing re-authentication in the MFA/OTP flow.

(from redmine: issue id 3711, created on 2016-06-29)