When a full authentication is needed (e.g. expired refresh_token) the
resource will show a notification instead of just firing up the auth
flow. This ensures that the user knows what is going on and the window
appears after they explicitly click a button, rather than a random
window or a browser popping up out of nowhere with no contextual
information of what is going on.