Only the service endpoint config goes in `cas.tac`; other configuration is in `cas.cfg`.
BUGFIX: SLO was not encoding unicode data to bytes.

Added a util function to flatten out nested Failures so they make more sense.
Twisted agent needs to follow redirects.

TODO: Double check that the final redirect follows the CAS protocol rules.
Log the significant CAS HTTP events.
Redact the password when logging HTTP events.