Tighten up some use cases

Title: Tighten up some use cases

All, here are some additional assumptions we should consider:

- Each SP should support/define only a single assertion consumer endpoint. I would recommend that index 0 be used for that endpoint. This implies that if an AuthnRequest asks for a specific endpoint, it will be the 0-indexed endpoint.

- For a Response, we should decide on whether we are signing the Response or the Assertion (i.e., only use one approach).

Tom.