Login: support uApprove consent revocation

The IdP running on the VHO can be installed with uApprove to ask users
for attribute release consent.

On traditional IdP installs using the default login screen, it is often
done to add a checkbox to the login form to allow the user to revoke the
consent already granted in uApprove.

For an VHO IdP, this has been slightly more difficult - I have added an
optional checkbox to _loginform.gsp and added logic into LoginController
that:
* saves the checkbox into a UAPPROVE_CONSENT_REVOKE session attribute.
* when establishing a session, if the session attribute is set, add it
  as a query-string parameter to the SSO_URL
* the uApprove filter then picks up the parameter from the request
  parameters.
* the only extra step to make this work is to apply the uApprove filter
  to /Authn/RemoteUser

Two new tests on LoginController to test this functionality.

All tests passed.
FYI this is reasonably brittle. I would recommend you consider [URIBuilder](http://groovy.codehaus.org/modules/http-builder/apidocs/groovyx/net/http/URIBuilder.html) instead to modify redirectURL