Using Duo for per-SP-opt-in

[Jorj Bauer]

Thanks to Dave and Scott: this was fairly easy to get working once I 
understood how the ECB configuration operates.

I've documented in the wiki how to replicate the old Shib2 behavior 
without using the entire ECB configuration:

   https://wiki.shibboleth.net/confluence/x/ZABlAQ

... if anyone sees errors in that article, feel free to correct them 
directly :)

-- Jorj

NB: also thanks to UChicago for sponsoring that work with Unicon. It's a 
much cleaner solution (IMO) than the Duo LoginHandler hook.