Update config variables to reflect code (#62)

AUTHN_REQUESTS_SIGNED was not documented but in code.
LOGOUT_REQUESTS_SIGNED was not documented, but in code.
WANT_RESPONSE_SIGNED was documented as a False but True in code.

Author: mvbattista

README.md

@@ -163,8 +163,10 @@ python setup.py install
         'JWT_EXP': 60,  # JWT expiry time in seconds
         'FRONTEND_URL': 'https://myfrontendclient.com',  # Redirect URL for the client if you are using JWT auth with DRF. See explanation below
         'LOGIN_CASE_SENSITIVE': True,  # whether of not to get the user in case_sentive mode
+        'AUTHN_REQUESTS_SIGNED': True, # Require each authentication request to be signed
+        'LOGOUT_REQUESTS_SIGNED': True,  # Require each logout request to be signed
         'WANT_ASSERTIONS_SIGNED': True,  # Require each assertion to be signed
-        'WANT_RESPONSE_SIGNED': False,  # Require response to be signed
+        'WANT_RESPONSE_SIGNED': True,  # Require response to be signed
         'ACCEPTED_TIME_DIFF': None,  # Accepted time difference between your server and the Identity Provider
         'ALLOWED_REDIRECT_HOSTS': ["https://myfrontendclient.com"], # Allowed hosts to redirect to using the ?next parameter
         'TOKEN_REQUIRED': True,  # Whether or not to require the token parameter in the SAML assertion
@@ -204,6 +206,8 @@ python setup.py install
 | **JWT\_PUBLIC\_KEY**                        | Public key to decode the signed JWT token.                                                                                                                                                                                                                                                                                                                                                                                                                  | `str` or `bytes` | `'--- YOUR PUBLIC KEY ---'`                                                                                                              |                                                          |
 | **JWT\_EXP**                                | JWT expiry time in seconds                                                                                                                                                                                                                                                                                                                                                                                                                                  | `int`            | 60                                                                                                                                       |                                                          |
 | **FRONTEND\_URL**                           | If `USE_JWT` is `True`, you should set the URL to where your frontend is located (will default to `DEFAULT_NEXT_URL` if you fail to do so). Once the client is authenticated through the SAML SSO, your client is redirected to the `FRONTEND_URL` with the JWT token as `token` query parameter. Example: `https://app.example.com/?&token=<your.jwt.token`. With the token, your SPA can now authenticate with your API.                                  | `str`            | `admin:index`                                                                                                                            |                                                          |
+| **AUTHN\_REQUESTS\_SIGNED**                | Set this to `False` if your provider doesn't sign each authorization request.                                                                                                                                                                                                                                                                                                                                                                                           | `bool`           | `True`                                                                                                                                   |
+| **LOGOUT\_REQUESTS\_SIGNED**                | Set this to `False` if your provider doesn't sign each logout request.                                                                                                                                                                                                                                                                                                                                                                                           | `bool`           | `True`                                                                                                                                   | |
 | **WANT\_ASSERTIONS\_SIGNED**                | Set this to `False` if your provider doesn't sign each assertion.                                                                                                                                                                                                                                                                                                                                                                                           | `bool`           | `True`                                                                                                                                   |                                                          |
 | **WANT\_RESPONSE\_SIGNED**                  | Set this to `False` if you don't want your provider to sign the response.                                                                                                                                                                                                                                                                                                                                                                                   | `bool`           | `True`                                                                                                                                   |                                                          |
 | **ACCEPTED\_TIME\_DIFF**                    | Sets the [accepted time diff](https://pysaml2.readthedocs.io/en/latest/howto/config.html#accepted-time-diff) in seconds                                                                                                                                                                                                                                                                                                                                     | `int` or `None`  | `None`                                                                                                                                   |                                                          |