* Let onelogin/php-saml know to use 'X-Forwarded-*' headers if it is from a trusted proxy
* Gracefully handle the case where openssl_csr_new fails when openssl.cnf is invalid/missing
* Improve ui of saml sp metadata by displaying it's url and a download button