Shibboleth authentication - URL changes

Sending the user to /api/auth/shibboleth/returned which well then get
proxied to /api/auth/shibboleth/callback at the appserver.

This allows apache to proxy back to nginx and not to the app servers directly