Refactored the Shibboleth authentication strategy

I've refactored the Shibboleth authentication strategy in favour of
using the standard Shibboleth Service Provider software.

This does mean we will have to run Apache + mod_shib in order to do
proper authentication. However, this also means we can gain access to
federations much easier. We can also start supporting built-in SAML 
functionality such as WAYF and/or discovery.
Although this does carry significant maintenance overhead, it's almost
certainly worth it.