After reading the rest of this PR, I think the answer here is "no". The issuer url in question is in the assertion, so whatever is there is fine.

It does bring up the issue where if you change the issuer url, I think all your prior assertions are now screwed. If that's true, we might want to note that in the documentation. Something like, "Don't change the url for your assertion. Srsly--it'd be bad." I wonder how that works for sites that switch from http to https-only.