auth_saml2 Ignore invalid idp request parameters

[aneno-m-e]

If the client sends us an idp request parameter that doesn't exist, we simply ignore it, instead of setting it in the session.

This can happen if user's store an old link, becuase saml2 sends you to default idp if it doesn't match, but the session variable still gets set to the invalid nonexisting idp

[danmarsden]

the use of $_GET makes me sad... it would be nice to clean that up and use optional_param at the same time here.

also - use of the double == looks weird to me and can we be even more clever and use something like array_key_exists() instead of needing the php loop?