allow responses to process encrypted section separately from unencrypted...

... part

SAML requests have an unencrypted and an encrypted part.
There is some info in the unencrypted part that can be used
to identify the correct settings for the SAML response.
(namely, the issuer) So this separates processing the
encrypted part from parsing out that needed information.