If Shibboleth sets duplicate attributes (REMOTE_USER, Shib_Identity_Provider, etc.), infer REMOTE_USER from eppn + persistent_id