send up ephemeral bit when authenticating with primary-issued assertion as well as when authenticating with a password