Assert AL2 based on norEduPersonNIN presence.

It seems most sensible to return an error SAML response in case
an SP requests AL2 but the user is not ID proofed to that level,
but for now we generate an error page in the IdP.