Fix Shib setting rules.

I think ShibRequireSetting was a mental mixup between ShibRequireSession
and ShibRequestSetting. I've replaced it with separate options for both. The latter is
an array as you can set multiple different settings, while the former is a simple
On or Off value. Each item in the settings array should be the name and value of the setting,
e.g. ['requireSession false', 'applicationId myresource']