CAS renew not honored in v3.4.1

[Cantor, Scott]

This cropped up in 3.4, yes? It's a regression, mine this time. I implemented a way to control ForceAuthn from the configuration (analagous to controlling AuthnContext when the SP can't do it) and I botched the CAS branch of that change. It's overwriting the flag from the message. I don't know why I didn't notice it when you first posted.

We're about to ship a 3.4.3 to fix the Template attribute def regression, I'll get this fix into the patch. Since it's a very short term problem, the simplest fix if you know of a specific service that always needs it on is to go ahead and use the 3.4 enhancement to turn it on at the IdP, and then once the patch is out next week and you have it, you could turn it back off there.

-- Scott