When authenticating over HTTP using SAML, which of the following is issued to the authenticating user?