SAML NameID comment injection

A comment inside the signed NameID can make the app read a different identity than the one the signature covered.