redirect to shibboleth auth when user needed
remove hardcoded user info
release config allows shib path