Validate provisioning and authentication endpoints

Let's do this closer to the data, not deep into the callers of the
well-known parser.
use blanket for coverage, inline instrumentation ftw
remove uneeded includes
Eliminate a variable reuse in claims extraction

These two sets of claims should always be kept completely separate
so let's use separate variables at all times when handling them.
Remove bogus comments (copy/paste leftovers)
improved handling of sloppy secondaries support documents
changes in 0.0.4
bump to 0.0.5 after publishing 0.0.4
Validate the authority field for delegating IdPs

The validation of that field should happen in the parser so that
invalid values never make it to the callers.
allow over-riding of principal in client testing tool
changes in 0.0.5
ver bump after publishing 0.0.5
improved error message
Convert string exceptions to Error objects

http://www.devthought.com/2011/12/22/a-string-is-not-an-error/
Add a test to make sure that "disabled: false" works
Be more strict about the format of "disabled"

While we could be more tolerant here than in the spec, the risk is
that the majority of developers will not read the spec and will
instead try something with our verifier and expect that it will
always continue to work the same way.

In other words, if we're too lenient at the start, we will be
stuck supporting an alternative syntax forever and will impose that
on third-party verifiers as well.
sloppy support document test case is more wholistic - tests from assertion rather than lookup in isolation: this verifies that parameters are passed along from verification to lookup
fix issue with fallback being forgotten - pass along arguments - always.
changes in 0.0.6
Remove lie in comment