Handles host-side authentication logic (this method is dependency injected
into the OIDC Provider instance).

If the user is already authenticated (their user id is in the session),
simply sets the authRequest.subject property and returns the request.

Otherwise, if not already authenticated, 302-redirects the user to the
/login endpoint.

@param authRequest {AuthenticationRequest} Auth request object created inside
an OIDC Provider in its /authorize endpoint handler.

@throws {AuthResponseSent} If the user has been redirected to /login

@return {AuthenticationRequest}
function authenticate (authRequest) {
  let debug = authRequest.host.debug || console.log.bind(console)

  let webId = authenticatedUser(authRequest)

  if (webId) {
    debug('User is already authenticated as', webId)

    initSubjectClaim(authRequest, webId)
  } else {
    // User not authenticated, send them to login
    debug('User not authenticated, sending to /login')

    redirectToLogin(authRequest)
  }

  return authRequest
}