* feature/interface-cleanup:
  Remove old SP interfaces in www/{saml2|shib13|wsfed}/sp.
  Remove backwards compatibility (related to old SP interfaces) in AuthMemCookie.
  Remove remaining references to long removed options 'enable.saml20-sp' and 'enable.shib13-sp'.
  Delete old SP metadata interfaces.
  Remove support for hosted SP metadata in MetadataStorageHandlerFlatFile.
  Remove support for hosted SP metadata in MetadataStorageHandler.
  Force XML_Shib13_AuthnRequest::createRedirect() to receive a shire.
  modules/saml: proper error message in SAML1.1/2.0 ACS when auth source ID is missing.
  docs: remove references to saml20-sp-hosted.
  docs: remove reference-sp-hosted and references to it.
  Remove code for old SP interface in frontpage/federation page.

protectmetadata was not enforced for SP metadata.

Make sure metadata-converter.php requires an admin user

Disable the loading of external entities in XML documents.

Add coveralls support

& make phpunit dev dependency explicit.

Updated the composer.lock to install satooshi/php-coveralls

Add .coveralls.yml to stop errors.

Added coverage_clover pointing to correct location.

json_path now... anything to get bin/vendor/coveralls to actually execute!

Only push coverage reports for a single version of PHP

Add whitelist + exclusion files to coverage.

Reduce code coverage % by processing all files :-)

Beware adding additional directories for tests without setting up config + mocking the rest of the environment.

Don't show uncovered files.

Attempt upload for all PHP versions. Is this stacktrace always generated?

Return to "true" for uncovered files.

There is a path problem somewhere!

To prevent local and remote file inclusion attacks. This is in most cases
already disabled by default in system libraries, so this will be a no-op to
most systems, but to be safe we explicitly disable it also.

Fixes #74

This check was not ported to the saml2 module.

Depending on server configuration this may be used in a Denial Of Service attack by tying up all webserver workers with large POST bodies.

Depending on server configuration this may be used in a Denial Of Service attack by tying up all webserver workers with large POST bodies.