Drafty work on authentication subcontexts

[Cantor, Scott]

I fleshed out the topic on authentication with some material on possible
organization of data into profile subcontexts.

https://wiki.shibboleth.net/confluence/display/IDP30/Authentication+and+Ses
sion+Management

My prelim. thinking was that we might use Java's Subject API to handle the
encapsulation of the non-normalized forms of identification in the system,
and then build the "disambiguator" component to take a Subject and turn it
into a normalized identifier.

So I was thinking an authn workflow could produce a Subject.

I'm not any kind of big fan of that API, but it seems weird to build a
whole new way of wrapping identifiers and arbitrary credentials.

Thinking maybe Brent and I can sketch out some end to end examples of
flows on Sunday/Monday to really identify what's missing for some
non-trivial cases.

-- Scott