if reauth token marked critical, don't allow EAP fallback