Scope unscoped saml2 tokens.

Scope unscoped federation token.
The plugin mimics standard v3.Token behaviour.

Change-Id: I81f30a7c893be15e715c57bd43035b12d8435f58
Implements: blueprint add-saml2-cli-authentication
Allow passing kwargs from managers to session

Resource managers may need to pass certain overrides down to the session
layer. The most common example would be to allow them to specify a
different interface to issue a request to than is common. It is possible
later that we may wish to expose this ability to users as well so that
they can choose in there own programs what interface, endpoint name etc
a particular request should be issued to.

Change-Id: I7ee0931d4ea78cf9f463b2f0b54457226c5bea8d
Enforce authenticated=False in saml2 plugin

All underlying HTTP calls executed via ``keystoneclient.session.Session``
object should have ``authenticated=False`` option enforced indicating the
plugin is not authenticated with the Identity Service yet.

Change-Id: I946f1ed6a55c4172d8f4bf6a24e5cbc3a00d1154
Rename saml2_token_url to token_url

For the consisteny a property returning authentication url
should be called token_url.
This patch renames ``saml2_token_url`` to ``token_url`` in the
contrib.auth.v3.saml2.Saml2UnscopedPlugin plugin.

Change-Id: I435a118bb31338a37a29eec68b8e9ce50d163675
Insert space between ``#`` and the comment

test_auth_saml2.py file has a comment:
 ``#for better readibility``. A space should be inserted between
 a ``#`` and the comment message.

Change-Id: Ic36bf9254beee9a3f6f1fa904184c17a28f4fa13
Merge "Insert space between ``#`` and the comment"
Merge "Enforce authenticated=False in saml2 plugin"
Merge "Rename saml2_token_url to token_url"