When no principal is available in the SP side, do not throw an
exception, instead just invalidate the session (will we have enough info
to trigger a logout @ the IDP side??)