Add a 'hide.from.discovery' configuration option for remote IdP metadata. This allows to hide an IdP from the discovery service. Defaults to false, so every IdP in the metadata that doesn't have this option set to true will be listed.

SimpleSAMLphp no longer requires mcrypt, it will only be needed depending on the configuration, so mark it as optional.

As per https://groups.google.com/forum/#!topic/simplesamlphp/nFXerlX839E

The text was copied from https://code.google.com/p/simplesamlphp/wiki/LostState, corrected some language and added a piece on http/https stemming from the comments on that page.

Fixes #214

It has never really gained traction and is now superseeded by the composer module installer.

Rename SimpleSAML_Session::getInstance() to SimpleSAML_Session::getSessionFromRequest(), and leave the former as deprecated.