v1.6.9

OIDC: the account is refreshed on every sign-in, signing out can end the provider session, and the login page can be sent straight to the provider.

• Refresh the account from the provider on every sign-in (#16). The display name was written once, at first sign-in, and never again — renaming somebody in the directory left FOG showing their original name forever.
• Single logout (#15). Signing out of FOG left the provider's SSO session intact, so clicking the provider button again silently signed the same person back into the same account. New per-provider setting, off by default; register the printed post-logout redirect URI at your provider if you turn it on.
• Send the login page straight to the provider (#17). New per-provider setting, off by default. Two flagged providers refuse to redirect rather than silently picking one.

The local login form is always available at https://<fog>/fog/management/login.php — one URL that never routes to an identity provider, whatever the settings above say. Tick the redirect setting only once you know that URL exists.

Requires core with FOGProject/fogproject#1174 and #1175 (the USER_LOGGING_OUT redirect return value, the LOGIN_PAGE_REDIRECT seam, and management/login.php).