Fixed a bug in the config API when the first char is a `{`
Refactored the Shibboleth authentication strategy
    
I've refactored the Shibboleth authentication strategy in favour of
using the standard Shibboleth Service Provider software.
    
This does mean we will have to run Apache + mod_shib in order to do
proper authentication. However, this also means we can gain access to
federations much easier. Although this does carry significant maintenance
overhead, it's almost certainly worth it.
    
The following technical changes have been made:
  -  Added a `ShibbolethMetadata` CF
     The Shibboleth authentication strategy will now persist:
       -  the Shibboleth persistent id
       -  the IdP
       -  the user's affiliation
       -  all the attributes that the IdP passed to us
     The information is keyed by the loginId. This allows us to retrieve extra
     attributes later on.

  -  `AuthenticationAPI.getOrCreateUser` now also exposes the loginId that is
     associated to a user object.

  -  Replaced underscore as a JST for authentication attribute mapping
     Rather than using underscore for attribute mapping, we now use basic
     variable interpolation.

     The syntax is of the form `{var}`.
     For example:
     Code:
         var template = '{firstName} {lastName}';
         var data = {'firstName': 'John', 'lastName': 'Doe'};
         var displayName = renderTemplate(template, data);
     Result:
         John Doe
Using /returned as the Shibboleth target
Add a README file in the Shibboleth auth strategy that explains the entire authentication flow and reasons behind it
Shibboleth follow-up

- Use signed cookies for storing the originating tenant
- SP endpoints are only valid on the configured shib host
- Align REST docs with existing conventions
- Added validation to the tenants API so tenants cannot be created with the same host as the configured shib host
- Added a `loginId` parameter to `getOrCreateUser`
- Brought in tough-cookie as a dev dependency
Shibboleth - Configurable external ID attribute

Added a configurable attribute that can be used to identify the user
with the identity provider. This allows us to pre-provision users through
a CSV file and be reasonably sure that they can be matched-up later on
Unify Context jsdoc parameters
1031 - Folders follow-up - minor stuff
Folder-create activity refinement

Adding a target when there is only 1 extra member
Added tests for the content-create target permutations
Updating the folder libraries asynchronously from folder updates
Fixed warnings on startup

* Not logging error during swagger recursion when /lib does not exist (as it is legal)
* Specifying widget directory filter for caching widget manifests/i18n bundles
More accurate notification counts

When incrementing the notification count for a user we take into
account whether the activity aggregated with an older existing activity.
If the new activity aggregated with such an existing activity, we do not
increment the notification count.
Notifiation count follow-up:

- The push streams can now contain multiple activities
- Notifications are sent to the push streams after aggregation
- Fixed up failing unit tests
Leaky push fix
Notification count - Fix for multiple aggregates
Fix for failing “notification reads” test
Fixed failing “verify userid in message id” test
Cleaned up folders rest model
Documentation fixes for folders follow-up