More S2ML configuration hassles

I forgot that you need to statically configure if URL-based assertion references have their
information in the URL only or in a cookie as well!

This "setting" would (of course) be automated using the previously described
scheme using challenge-reponse authentication.

Anyone who knows any more configs I have forgotten?

/Anders