SAML principal attribute release must pass through the policy

This pull request addresses issue #639
This constructor is very strange: I didn't notice the ```defaultAttributes``` argument: is it really used somewhere?