Fix configuration documentation and an invalid code comment

Add documentation for the identityProvider/allowUnsolicitedAuthnResponse configuration attribute.