the saml2p:Scoping block in authn requests

[Cantor, Scott]

> I didn't say I thought it was normal; it was just in the ECP excerpt that we
> started with, and at this point, I can't remember where we even started.

I think the SP might include it because Scoping has an obscure ability to include the name of an IdP so a client UI could display it. In that scenario, it's not inside the AuthnRequest, it's in a SOAP header for the client to read.

-- Scott