Set Assertion ENV var when attribute is empty

[Cantor, Scott]

> AFAIR that's not legal in SAML (empty strings, empty attributes), but either way
> maybe the IDP should do things differently.

I'm not a fan, but it is legal, there's very explicit language about it for AttributeValue content overriding the usual rules. I really have no memory of what the code does with it, but since the header export requires clearing out unused headers, it wouldn't be possible to tell the difference between missing and empty in some configurations.

-- Scott