Shibboleth follow-up

- Use signed cookies for storing the originating tenant
- SP endpoints are only valid on the configured shib host
- Align REST docs with existing conventions
- Added validation to the tenants API so tenants cannot be created with the same host as the configured shib host
- Added a `loginId` parameter to `getOrCreateUser`
- Brought in tough-cookie as a dev dependency