When the Pelaying Party sends an authentication request with fresh = 0 then user receive logon form.
User may change GET request in Browser to wfresh = 1 and successfully authenticated without logon form.
How to prevent the parameter 'wfresh' alteration?
Is the only one solution for RP to use SAMLP (ForceAuth=true) with signature instead of WS-Fed (wfresh=0)?