RE: [security-services] List of possible implementation features forSAML 2.0

> this may add perhaps too much detail - but do you want to capture the fact
> that the HTTP Artifact binding can use HTML forms or URL encoding to
> transport the artifact (albeit that conformant implementation for this
> binding MUST implement both)

It was my hope we'd just bury that inside the binding and not have to call
it out in conformance. Given the choice between that and having to make
things even more complex there, I'd actually be in favor of just backing off
to GET.

I just think allowing POST is a good nod toward security without costing us
much in complexity.

-- Scott