If SSO enforcement is enabled and the user has signed in without
using that group's SAML session we previously just denied access.

Now we will instead redirect the user to that group's sign in page.