- UA-specific changes to IdP metadata, attributes, etc
- add optional "authz" option to Strategy, to facilitate checking of attributes at time of authentication
- set acceptedClockSkewMs to 180000 (3 mins); this is the Shibboleth SP default