Implemented /serviceValidate endpoint; CAS attributes are released from avatar.

TODO: There should be a mechanism to determine if the attributes should
be released to the service.  Not sure where this should go.  Probably
the UserRealm should have some way of knowing which avatar attributes to filter.

Note: I hard-coded the login ticket timeout, as it was way too short.
I need to make the settings configurable via some sort of config file.