In the SAML 1 and 2 attribute query flow tests, if I comment-out adding the SP credential to the HTTP servlet request, the tests still pass, which is not what I expected. I thought that something in the flow would validate the SP certificate, but I guess not. Is that functionality not implemented or am I misunderstanding ? Thanks.