Force OTP for some roles after identity provider login (#2)

This was a really gnarly one. The database became a little corrupted during my testing and I had to manually clean it up.

Anyway, I tested this fairly extensively and I'm pretty happy with results.