Better support CAS attribute release

Currently our CAS logic uses `/serviceValidate` to validate an incoming ticket and get user attributes. There used to be a time where CAS deployers were manually changing a JSP file on their end which added in the attributes in the appropriate XML format. That is no longer being done however. [1]

With CAS protocol version 3 there are now 2 new ways of obtain user attributes.
 * Via SAML 1.1 at the `/samlValidate` endpoint
 * Via a CAS protocol version 3 endpoint called `/p3/serviceValidate`

We should look into ditching our custom build of cas-sfu and look at extending something like https://github.com/sadne/passport-cas as it that seems to support the new `/p3/serviceValidate` endpoint. It would be nice if we could add the `samlValidate` endpoint and contribute it back. We will probably have to add a configuration option where we can select what type (cas2, saml, cas3) of CAS version the tenant wishes to use.


[1] That said, one of our tenants (AAR) is doing exactly this. Their `/serviceValidate` endpoint releases the following:
```
<cas:serviceResponse xmlns:cas='http://www.yale.edu/tp/cas'>
<cas:authenticationSuccess>
<cas:user>susantest50</cas:user>
<cas:attributes>
<cas:attraStyle>Jasig</cas:attraStyle>
<cas:uid>49033</cas:uid>
<cas:mail>susansnider@gmail.com</cas:mail>
<cas:created>1372256560</cas:created>
<cas:language>en-gb</cas:language>
<cas:drupal_roles>authenticated user</cas:drupal_roles>
<cas:drupal_roles>expired user</cas:drupal_roles>
<cas:first_name><![CDATA[Susan]]></cas:first_name>
<cas:last_name><![CDATA[Snider Test 50]]></cas:last_name>
<cas:contact_id>47503</cas:contact_id>
<cas:custom_29><![CDATA[]]></cas:custom_29>
<cas:institution><![CDATA[]]></cas:institution>
<cas:title></cas:title>
<cas:street_address><![CDATA[123 Street]]></cas:street_address>
<cas:street_address_2></cas:street_address_2>
<cas:street_address_3></cas:street_address_3>
<cas:city><![CDATA[Atlanta]]></cas:city>
<cas:state_province_name><![CDATA[New York]]></cas:state_province_name>
<cas:postal_code><![CDATA[10001]]></cas:postal_code>
<cas:country><![CDATA[United States]]></cas:country>
</cas:attributes>
</cas:authenticationSuccess>
</cas:serviceResponse>
```
I think this will have to be made configurable as we'll want to run some older tenants against CAS1.0 (`/validate`) or CAS2.0 (`/serviceValidate`)