Get shib attributes from environment variables first if available.

A tiny patch to first try to get the shib attributes from environment variables and if that fails from HTTP headers. This since environment variables is the safest mechanism for retrieving the attributes.

The shibboleth wiki on SP attributes: https://wiki.shibboleth.net/confluence/x/JIBC