Added ability to identify if a service should participate in SSO or demand credentials.

This is like the `renew` option of the protocol, but it is enforced from the
CAS server configuration, not requested by the service.