re #1059 changed shib athentication plugin config to use the EMAIL header instead of SHIB-EP-SCOPED-AFFILIATION for determining roles