Fix revoking a scoped token from an unscoped token

When a scoped token that was created from an unscoped token was
revoked, the original token wound up being revoked. This is because
the scope wasn't included in the revocation event. By including the
scope in the revocation event only the scoped token is revoked.

Change-Id: I5652663ab7e1176d3b1efc5d218a8a020498067e
Closes-Bug: #1347318
Improve instructions about federation

This patch clarifies two elements:

1. According to Shibboleth's documentation the ShibRequireAll command
is not supported on Apache 2.4+, details can be found at
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApacheConfig

2. Some configurations of Apache + Shibboleth SP will always set the
REMOTE_USER env variable, even if it is an empty value; this can
lead to unexplained authentication errors that can be avoided if the
external auth method is disabled.

Change-Id: Iaf4e57e7e3d79a2e87e805bbe8340861ee9c3db3
Merge "Fix revoking a scoped token from an unscoped token"
Merge "Improve instructions about federation"