native SP logger enhancement: include applicationId

[Cantor, Scott]

> The current (simple) configuration requires all requests to be authenticated,
> starting a complete authentication process for any unauthenticated one,
> redirecting them to the discovery service:

Yes, but that's your decision to make, you can turn off that setting.

> One may imagine another configuration that would try to make a distinction
> between requests resulting from human-initiated action (GET requests, for
> instance), and those sort of keep-alive background requests.

Yes, by using different URLs probably.

> In both case, this seems to be a job for the web server, provided it can
> process requests before they are handled to the native mod_shib handler,
> and can distinguish authenticated from unauthenticated requests.

Yes, exactly. So certainly, you can do it, but it's not a matter for the SP, which already provides the ability to delegate session decision making to the app.

-- Scott