remove signature element for a log out request

SAML 2.0 spec requires the signature element be removed from
the request body.  This commit removes the signature in the body.

See lines 578-579 in http://docs.oasis-open.org/security/saml/v2.0/saml-bindings-2.0-os.pdf
Merge pull request #20 from ncloward/original_version

remove signature element for a log out request
bump version to 0.1.26 to match rubygems.org
Merge pull request #21 from ncloward/original_version

bump version to 0.1.26 to match rubygems.org
don't add newlines to the base64 encoded data
bump version to 0.1.27
Merge pull request #22 from codekitchen/base64_newlines

Base64 newlines
protect against XML envelope attacks

after verifying signatures, we build a list of "trusted roots" by walking
up to the elements referenced by the xml signatures. then we only query
against those trusted roots for details of the assertion.
gem tasks for easier releasing
guard against duplicate id XML signature envelope attacks

because we have to use xmlSecAddIDs to get xmlsec to be able to
dereference signature references in SAML responses, a specially crafted
document with duplicate IDs can fool xmlsec into validating a signature
outside of the ancestry of the reference. this provides an attack vector
for injecting an unsigned assertion.

the solution is to catch the error thrown when xmlsec sees the duplicate
ID and immediately treat the response as invalid when this occurs.
bump version to 0.1.28
disable xslt transforms and remote references