SPFormAuthenticationMechanism is not servlet and should be properly extendable

@WebListener-Annotation doesn't make sense as the class is actually no Servlet-API-conform Listener. That's why the deployment fails if you put this class in a deployment --> should be removed
the attribute idpMetadata is private and therefore not accessible for subclasses, so I need to copy it and all initialization-methods for this attribute.
--> should be protected (like the other attributes too)