Multiple IdPs without discovery

[Peter Schober]

* Ted O'Connor <toconnor at gmail.com> [2014-03-20 17:58]:
>  This seems to work for me now:
[...]
>     require valid-user
[...]

Other than for authorization, yes:

* Peter Schober <peter.schober at univie.ac.at> [2014-03-20 15:26]:
> Avoiding discovery is one thing, you still need authorization rules
> (otherwise someone successfully authenticated for one vhost could
> still access any other vhost as long as her session was active).

-peter