GitLab.com SAML prevents web access via redirect, forcing reauthentication

Part of https://gitlab.com/gitlab-org/gitlab-ee/issues/5015

GitHub approach

• If the GitHub user's session with the IdP provider has expired:
  • Visit organization homepage: shows SSO page
  • Visit page in private or public repo: shows SSO page
  • E-mail notifications from private or public repo: receives as normal
  • Web notifications from private or public repo: asks to single sign-on to view
• If anonymous:
  • Visit organization homepage: shows as normal (GitHub organization cannot be private)
  • Visit page in public repo: shows as normal
  • Visit page in private repo: shows 404 page