It does not seem like something that is normal so a warning seems in
place. However, forbidding it does not add much value since we accept
unsollicited responses (from any idp) anyway.

Closes: #975

See https://github.com/simplesamlphp/simplesamlphp-module-casserver

Fixes #873

SHA-1 is still supported but needs to be configured explicitly if you need it.

It was already added under 1.15