Make signing of SAML requests optional

The majority of IdPs do not require this, so it makes setup substantially more difficult than necessary. You can signup for a free 30 day trial with Okta or OneLogin to verify (or I can send screenshots showing this is the case).

For a service provider (SP), failing to sign requests makes the whole process worthless. On the IdP side, it's less important. It is only necessary if the IdP wishes to verify that the request really comes from an SP it trusts. E.g. if the SP requests certain confidential attributes to be disclosed (that not all SPs should see), and possibly to encrypt those attributes in the response so that only this SP can read it.

Here's [a really good overview of SAML](https://www.oasis-open.org/committees/download.php/12958/SAMLV2.0-basics.pdf). The IdP is going to say something like "Joe authenticated with a password at 9:00am and is a member of the Engineering group". An SP can then take that information and give the user access to it's application knowing that the user is authenticated to the IdP. If a malicious actor were to find out that Joe is logged in to the IdP then in general there is not much they can do with that information. For that reason, most IdPs do not make attempts to protect this knowledge given the extra setup burden it requires. If the end user wishes to set this up for extra security, they may, but in the general case it isn't asked for.
You hit an interesting point here by using the same decrypter instance for all authentication requests. Initially there was a new instance for every requests because I was not sure the decrypter is thread-safe. However after spending some time in the OpenSAML source code, I feel the decrypter is thread-safe so I would agree on this scenario. @benmccann do you also check the OpenSAML source code? Do you share my analysis?