Adopt BoD-approach of dealing with shibboleth.
Add some nice logging
Reinstate ApiOauthFilter, get shibboleth attributes from request
Don't redirect to non-existing jsp
Add idpId and a nice toString()
Use an enum. It's 2014.
Add idp id to token
Fetch user's institution id.
Make sure authorities are present