Path access control, a bit better

[Young, Darren]

>/Shibboleth.sso/Session, after adding the showAttributeValues option to
>the handler so it dumps things out.

Thanks, side question, is it *actually* necessary to restart shibd_default
after making those types of changes? The value is there and false, I¹ll
set it to true. Is restart needed?


>Incidentally, that non-OID URN is invalid, you don't have standing to
>define names like that.

I wondered about that a couple years ago, don¹t know how we¹d assert that
we can make that definition. It¹s part of a chunk of attributes that came
out of documentation in IAM here, they landed in an SP config and have
been copied ever since.