As somewhat hinted in the notice available in the first link you mentioned given that acr_values are now supported that should be your choice as they are standardized while the step_up flag was a custom implementation. In addition, to my knowledge the fact that the client application is a SPA should not affect this decision in any way.