#502: saml authn attributes dont appear in validation response

This PR fixes issue #502
I don't know SAML protocol, but authentication attributes and principal attributes would be returned at the same level, right?
Are clients able to consume all these attributes? How can they tell ones from the others?