For now hardcoding host@<hostname> for the URL values since that's what
the ssh client sets the target name to.

Also now looking for SessionNotOnOrAfter in AuthnStatement.