Produce more helpful logs
Prevent user spoofing by not using http headers; make authentication thread save

Instead use enviroment attributes through request attributes interface as
suggested by shibboleth docs.
Thread safety by not using object variable for user attributes but creating
the object upon function call and passing it around.