[Wang Yan] skip verify_authenticity_token for saml call back

Actually okta integration has finished, but this call back is blocked by "protect_from_forgery with: :exception" in application controller. so just skip verify_authenticity_token will be ok.