add groups and logout support to SAML authn (#867)

The patch implements a proper SAML logout and adds tags with '$sgcn_'
prefixed to the name of the groups supplied by the IdP for the user
(similar to the way groups are handled for LDAP). The SAML attribute to
get the list of groups from is specified with the groupListAttribute key
in the $SAML_options in the configuration.
add some finish to the previous commit