Fix a bug where SAML Attributes/AD FS claims are not decoded because a prefix is not set.
Ensure that the logoutRequest checks against the original Value of the Query String.
This resolves a verification fail using AD FS.

As specified by "Bindings for the OASIS Security Assertion Markup Language V2.0"
http://docs.oasis-open.org/security/saml/v2.0/saml-bindings-2.0-os.pdf

Quote: "Further, note that URL-encoding is not canonical; that is, there are multiple legal encodings for a given
value. The relying party MUST therefore perform the verification step using the original URL-encoded
values it received on the query string. It is not sufficient to re-encode the parameters after they have been
processed by software because the resulting encoding may not match the signer's encoding."
Allow a specification of supported AuthnContexts.

To configure just set allowedAuthContexts in settings.php
as for example 'security'=>array('allowedAuthContexts'=>
'allowedAuthContexts'=>false; //You don't want a limitation
'allowedAuthContexts'=>array('urn:a', 'urn:b') //Limited to these two

This allows using IWA (Internal Windows Authentication) using AD FS,
because not only forms authentication is supported.