Fixed a bug in the config API when the first char is a `{`
Refactored the Shibboleth authentication strategy
    
I've refactored the Shibboleth authentication strategy in favour of
using the standard Shibboleth Service Provider software.
    
This does mean we will have to run Apache + mod_shib in order to do
proper authentication. However, this also means we can gain access to
federations much easier. Although this does carry significant maintenance
overhead, it's almost certainly worth it.
    
The following technical changes have been made:
  -  Added a `ShibbolethMetadata` CF
     The Shibboleth authentication strategy will now persist:
       -  the Shibboleth persistent id
       -  the IdP
       -  the user's affiliation
       -  all the attributes that the IdP passed to us
     The information is keyed by the loginId. This allows us to retrieve extra
     attributes later on.

  -  `AuthenticationAPI.getOrCreateUser` now also exposes the loginId that is
     associated to a user object.

  -  Replaced underscore as a JST for authentication attribute mapping
     Rather than using underscore for attribute mapping, we now use basic
     variable interpolation.

     The syntax is of the form `{var}`.
     For example:
     Code:
         var template = '{firstName} {lastName}';
         var data = {'firstName': 'John', 'lastName': 'Doe'};
         var displayName = renderTemplate(template, data);
     Result:
         John Doe
Using /returned as the Shibboleth target
Add a README file in the Shibboleth auth strategy that explains the entire authentication flow and reasons behind it
Shibboleth follow-up

- Use signed cookies for storing the originating tenant
- SP endpoints are only valid on the configured shib host
- Align REST docs with existing conventions
- Added validation to the tenants API so tenants cannot be created with the same host as the configured shib host
- Added a `loginId` parameter to `getOrCreateUser`
- Brought in tough-cookie as a dev dependency
Shibboleth - Configurable external ID attribute

Added a configurable attribute that can be used to identify the user
with the identity provider. This allows us to pre-provision users through
a CSV file and be reasonably sure that they can be matched-up later on
Merged master into shibboleth
Use new  method
Documentation follow-up for Shibboleth