Fix 'Access Denied: Invalid Recipient' error due to http/https mismatch

SAML validation was failing - recipients did not match due to https in the Assertion and http in the app url. I also expanded the instructions in configure.jsp, including adding the `--app appname` parameter to the `heroku config` command line.