eduPerson recommends: 'Multiple "@" signs are not recommended, but in any case,
the first occurrence of the "@" sign starting from the left is to be taken as
the delimiter between components. Thus, user identifier is to the left,
security domain to the right of the first "@".'

Closes #236

This would otherwise terminate win an error because checkURLAllowed
does not accept a null parameter.

Currently the remember me functionality does not work correctly and using it results in severable undefined index errors as the expire cookie parameter is passed along the SessionHandlerPHP which does not accept this one. Using lifetime instead of expire, effectively doing the same thing, this can be fixed in a pretty simple way. Next to that the params given to the session handler are merged with the current ones before given to the session handler instead of after.

When looking up the IdP to authenticate, the try/catch block would
swallow the more specific exceptions that are generated and display
them all as a single 'not found' exception. This means that the
more specific "Metadata not found" exception page was never rendered,
or also the "Metadata expired" exception not displayed. We don't
need the try/catch here, instead can rely on the exceptions that this
call will generate by itself.

Incorrectly refactored in eb204573