Co-authored-by: Tim van Dijen <tvdijen@gmail.com>

eduPerson recommends: 'Multiple "@" signs are not recommended, but in any case,
the first occurrence of the "@" sign starting from the left is to be taken as
the delimiter between components. Thus, user identifier is to the left,
security domain to the right of the first "@".'

Closes #236

This would otherwise terminate win an error because checkURLAllowed
does not accept a null parameter.

When looking up the IdP to authenticate, the try/catch block would
swallow the more specific exceptions that are generated and display
them all as a single 'not found' exception. This means that the
more specific "Metadata not found" exception page was never rendered,
or also the "Metadata expired" exception not displayed. We don't
need the try/catch here, instead can rely on the exceptions that this
call will generate by itself.

Improve error handling

Although strictly 'less correct'. When manually converting
metadata, this is not such a useful note, and frequently gives
rise to trouble when the output is copied to somewhere static.

Previously, would show inappropriate precision, like "0.0598134 hours ago"
or "1490532.4129 hours from now" depending on the expiration date.

* Configurable ProviderName

Co-authored-by: Tim van Dijen <tvdijen@gmail.com>

Closes #1346