disable SubjectLocality in assertion

[Cantor, Scott]

> > I don't consider it very reasonable, and as far as I recall we don't support suppressing it.

I don't see anything in the code that would allow it. An unsupported fix would involve unwiring the HttpServletRequest property from the AddAuthnStatementToAssertion action in the flow's bean definitions. I believe that would cause it to be omitted without any other impact at this particular moment.

-- Scott