double shib working

got the double shib redirect working so now we have one shib install
protected by another. this is working nicely and feeding remote user
through. now just have to set up distinct ldap database for vo and get the
open subscription id provider "id" working. also need to refine the arp
and aap so the vo system env gets a consist set of attributes from the vo
database.