Changes based on integrating with ADFS, Azure, and PingOne

[samv]

Just to let you know, we've been successfully integrating our product against various SAML implementations using this code, and here are some of the changes which we've found are necessary. There's a caveat that not all the changes are completely API compatible, and we're not done, but I just thought I'd open this PR so we can start talking about what it will take to converge.