auth/gensec: always verify the wanted SIGN/SEAL flags