SAML principal attribute release must pass through the policy

This pull request addresses issue #639
The login webflow is also at ```order="2"```, I don't think it's a big deal, but I'd prefer to increase the orders defined for the two webflows...