Fixes for AD FS compatibility

This PR changes some things to make the plugin work with AD FS (tested with the newest version on Windows Server 2012 R2):

- disable Scoping in the authentication request - AD FS does not support scoping and throws an error instead of ignoring it when present in the request
- change the Assertion Consumer Binding to POST to make sure that AD FS responds correctly
- use `getNameID()` instead of pulling the username out of the attributes
- increase the maximum session age at the IdP to eight hours (Spring Security's standard is two hours)

The last one is not an AD FS-specific change and it would probably be best to expose it as a property.

I'm also not sure whether these changes will break interoperability with other IdPs (I don't have much experience with SAML outside of AD FS).