no NameID in an unsolicited SAML2 Response

[Cantor, Scott]

BTW, Nate mentioned the other day, accurately, that usually an audience
mismatch happens when the IdP thinks an endpoint is owned by entity Foo
but the SP running there calls itself Bar. That mismatch is what leads to
the audience error.

In an unsolicited flow, the only identity the IdP gets of the SP is what
you give it in the query string, so there's no guarantee the name of that
SP is accurate in terms of having it come from an actual SP making a
request.

-- Scott