introduce thread safety to saml schema validation:

* per the references below, use of `Dir.chdir` is not
  thread-safe. this usage was causing exceptions to
  be raised when running on Puma and in other
  multi-threaded environments.
* this patch also moves the schema read up to a
  class instance, as this data is static and does
  not need to be read every time an assertion is
  validated. this boosts performance, especially in
  environments with higher throughput.

thanks to @dannyb for the assistance!

References:

* https://www.ruby-forum.com/topic/165079
* https://bugs.ruby-lang.org/issues/9785
* http://www.justskins.com/forums/working-directory-in-thread-42304.html
* http://www.ruby-doc.org/core-2.1.5/Dir.html#method-c-chdir
ensure IdP certificate is formatted properly:

* when loading the provider certificate from the environment, or
  integrating via `omniauth-saml`, we would often encouter a series of
  `nested asn1 error` messages due to the malformed certificate failing
  to be read by `OpenSSL`.
* inspiration for this patch comes from toyokazu/rack-saml@b7646ad

thanks to @dannyb for the assistance!