Fix service validation errors.

- MUST use memory-based storage service due to session lookup on back
  channel during service ticket validation.
- XML encode input that is outside control of CAS components.