Implement initiating logout from s2repoze plugin.

Adds a new repoze config option path_logout to the challenge decider
plugin. When a request is received on this url a global logout request
is initiated. Responses to this request is received on the
single_logout_service endpoint of the sp as configured in saml config
of the sp. Tested with only on IdP and only using HTTP_REDIRECT bindings

TODO: handle receiving logout requests on the single_logout_service endpoint
Allow graceful handling of auth_tkt cookies outliving saml clients cache

If for some reason the session cookie outlives the saml clients cache,
for instance if the webservice is restarted there could be an
inconsistent state where the user is authenticated but saml attributes
are missing and saml logout requests will fail. By using only saml2sp
as authenticator plugin and repoze.who 2.0 this little check will work
around that and require a new login in this case
Added support for receiving SAMLRequests on the single_logout endpoint
Merge remote-tracking branch 'upstream/master'
Loosen explicit requirement on repoze.who 1.0.18 as 2.0 seems to work fine
Merge pull request #44 from sigmunau/master

initial support for single logout in s2repoze