get signing working with openam and simplesamlphp

 - specify Destination in LogoutRequest
 - implement query_string signing, which openAM expects if the
   logoutrequests are coming in signed
 - make xml_security calls functional instead of extending
   SignedDocument on XMLDocument; this fixes an occasional
   libxml-based segfault coming from flipping out decrypted elements in
   the same XMLDocument
 - add tests around fingerprint verification and fix a bug; we were
   passing down the wrong option cauding a wrong fingerprint to never
   get rejected
 - get some inital tests around LogOutRequest, which was sorely in need
   of some tests