Deactive SSO and keep Context Handler stateless

[strandbygaard]

SSO is a problem with SAML2 scoping to upstream IdP, because the upstream IdP will only send JFR for the US the user is logging in to. When the user then get's SSO to another US, then the original token from upstream IdP will not contain JFR for the second US.

Effectively that means, that if context handler uses SSO, the the token from upstream IdP must contain all JFR.

Since the user normally has SSO with upstream IdP (e.g. municipality or NemLog-In) disabling SSO would have limited impact on the end users.

On the positive side, disabling SSO on context handler would make it possible to use scoping upstream IdP, and would reduce the memory pressure of CH, which would increase the performance. This would be most noticeable with STSI-680 because of its requirement to keep bootstrap token in memory.