clarification of unsolicited SSO behavior

[Cantor, Scott]

> The documentation on unsolicited SSO [1] doesn't say how the IdP
> chooses an endpoint location from SP metadata if one is missing in the
> protocol message.

It picks the default endpoint, per the spec.

> Of the outbound bindings supported at the IdP, which
> takes precedence?

The binding isn't what determines the default, that's not how metadata defaulting is defined.

-- Scott