NameIdFormat shoudl only be required for SPs

Some IDP can't handle a NameIDFormat in the AuthnRequest, it turns out.