Consent with CAS

[Nate Klingenstein]

> I don't believe uApprove did anything with the subject either

I have other bugs that I’d file against that project if it were still under development, specifically around a lack of sanitization of values before they’re presented on the page.

> but in any case, the current implementation knows nothing about it, and it runs long before the NameID generation step.

Fun times.