Issue9

Moved the setting of forced auth and passive to constructor of the LoginHandler rather than per request. Updated unit tests
I spoke to Mike and Dave about this option. We determined that there is no need for the idp to be able to override these. They should always be set to true.