Is the SAMLRequest parameter superfluous when not signing requests?