minor refactorings

notice the ```skip_before_filter :verify_authenticity_token``` in the SamlSessionsController