consent: Authentication session cookie invalidation scenarios

[aeneasr]

Let's look at the remember flag. If remember is set to false, then this has currently no effect to an existing AuthN cookie. So let's assume:

1. AuthN cookie has user sess-user authenticated
2. Request is forwarded to login endpoint
3. Login endpoint accepts login with user not-sess-user and remember: false

Then currently, this has no effect on the session. So after this flow, sess-user is still authenticated although a different user has authenticated.