Clarify SSO communication between IdP and SP

This change clarifies some of the documentation, correctly identifying where the IdP and client sit within a SAML session. This is gleaned from the admittedly basic SAML information on Wikipedia (http://en.wikipedia.org/wiki/Security_Assertion_Markup_Language), which identifies the IdP as OneLogin, the SP as the service being communicated with on a webserver, and the User Agent (or user's client, here) as the intermediary that talks to both.

This is relevant because service providers /need not be routable from the IdP/. This clarification prevents others from being confused in the same way I was, in which no further documentation clarified the intent of this article. I've also gone ahead and added a clarification for HTTPS support, which is not needed (but highly encouraged through a tool like stunnel) through my experience working with the demo-django application.

Thank you for reading and for providing these code. I have found it to be quite helpful.