CAS-1468: X509SubjectAlternativeNameUPNPrincipalResolver

Microsoft (and others) support the embedding of a UserPrincipalName object as a SubjectAlternateName extension within an X509 certificate, allowing properly-empowered certificates to be used for network logon (via SmartCards, or alternately by 'soft certs' in certain environments). An X509UserPrincipalNameResolver class would make the use of CAS as a web single sign on solution incredibly easy for AD domains with an existing PKI infrastructure.
How do we know the length/size of the sanItem list? It's worth documenting that in the javadocs, and also for safety, check for size before accessing the element at that index?