SNAA cleanup: Shibboleth now working, authorization is a TODO