update to opensaml 2.6.1, downgrade to spring-security 3.0.5
fix whatever happened to UntrustedCertificateException.java