Fix LogoutResponse issuer validation and implement SAML Response issuer validation.  Related to Pull Request 116

Review this PR, a solution for the #116 
hey @pitbulk I don't think the endpoint is correct, it states `/saml2/metadata/<app-id>` which I don't see is being defined anywhere in our routes, in any case that would be `/saml/metadata/<app-id>`