Incorrectly looking at request for forced/passive

[chasegawa]

The login handler should pretty much mimic what the MCB one is doing:
https://github.com/Internet2/Shibboleth-Multi-Context-Broker/blob/master/mcb-project/src/main/java/edu/internet2/middleware/assurance/mcb/authn/provider/MCBLoginHandler.java#L130 rather than looking at the request

[jtgasper3]

I think this related to what I found today. The passive response is ineffective. It should do something like:

log.info("Passive authentication requested without a valid SSO session. Returning SAML error to SP [{}]", entityId);
AuthenticationException ae = isPassive ? new PassiveAuthenticationException("Passive authentication not supported without a previous session.")
    : new AuthenticationException("The user could not be authenticated for an unknown reason.");