Saml2WebSsoAuthenticationFilter should allow requests through when SAMLResponse is absent

[jzheaux]

When an application requests /login/saml2/sso/okta, the default entry point for IdPs to POST a SAMLResponse, the endpoint will throw an exception if the SAMLResponse is missing.

It would be more flexible to instead allow these requests to pass through the filter chain in case another filter or MVC mapping would like to process the endpoint. One reason for this would be if the payload deviates from the SAML 2.0 standard.