saml2idp: give a more useful error message if asserting the request failed

...instead of a 500 ISE.

This is usually caused by failed acs_url checks against SAML2IDP_REMOTES.