Identity provider: urn:parcelpilot:idp
In a real deployment this page would redirect to the IdP. In the lab you can POST a
base64 SAMLResponse assertion to /saml/acs to establish a
session. The assertion parser rejects DTD/entity declarations.