During user-interactive authentication via single-sign-on, give a better error if the user uses the wrong account on the SSO IdP.