signature wrapping attack on assertion signature