Add support for IdP-initiated login
    
    This uses the Redirect SSO endpoint and two new optional
    arguments: SPIdentifier and RelayState.
    
    SPIdentifier is the provider ID of the SP.
    RelayState is where on the SP the user should be sent.
    
    If the user is already authenticted then a SAMLResponse is generated
    and the existing HTML page is generated and sent to the user including
    this response and the value of RelayState (if any). This will then POST
    to the SP and the user will be show the page on the SP.
    
    If the user is not authenticated then they will be given the login page
    after which they will be sent to the SP.
    
    The link to the SP on the IdP Portal has changed to be and IdP-initiated
    login. If a user bookmarks this link then they will always go to that
    SP and be authenticated first, if needed.
    
    https://fedorahosted.org/ipsilon/ticket/138
    
    Signed-off-by: Rob Crittenden <rcritten@redhat.com>
    Reviewed-by: John Dennis <jdennis@redhat.com>