make it possible to require IdPs or SPs in the ACL, log if not specified