Returning a True from the invalidate() call means that something has
changed within the plugin and the session should reissue the request and
expect the plugin to authenticate itself.
This means we should only return True if something actually changed,
because re-issuing the request if there was no auth_ref will not change
the outcome.
Change-Id: I012dacc93b1fcaee31d31a49e95db5a38044f211