processAssertion now returns identityIssuer
cookie and request now include issuer, and require logic checks it