Path access control, a bit better

[Young, Darren]

>/Shibboleth.sso/Session, after adding the showAttributeValues option to
>the handler so it dumps things out.

Here¹s what I¹m getting from /Shibboleth.sso/Session for me, 76 values for
the ucisMemberOf sounds about right.

MiscellaneousSession Expiration (barring inactivity): 479 minute(s)
Client Address: 10.135.211.154
SSO Protocol: urn:oasis:names:tc:SAML:2.0:protocol
Identity Provider: urn:mace:incommon:uchicago.edu
Authentication Time: 2017-07-12T16:45:56.753Z
Authentication Context Class:
urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
Authentication Context Decl: (none)

Attributesaffiliation: 2 value(s)
cn: 1 value(s)
displayName: 1 value(s)
entitlement: 4 value(s)
eppn: 1 value(s)
givenName: 1 value(s)
mail: 1 value(s)
nickname: 1 value(s)
persistent-id: 1 value(s)
sn: 1 value(s)
ucDepartment: 1 value(s)
ucisMemberOf: 76 value(s)
uid: 1 value(s)
unscoped-affiliation: 1 value(s)

>