- isPassive is not allowed
	- both AssertionConsumerServiceIndex and AssertionConsumerServiceUrl+ProtocolBinding must not be set
	- ForceAuthn attribute must be present if SPID level > 1
	- Issuer must be set to "urn:oasis:names:tc:SAML:2.0:nameid-format:entity"
	- The same public key info is provided twice in getSignature()

other minor changes:
	- added maven generated dirs to .gitignore
	- privateKey must not be logged
	- option to not compress authnrequest when using POST binding

…ailure