check for null openid port in the case where none is specified (preferred) we don't get caught doing a test against null
check for null openid port in the case where none is specified (preferred) we don't get caught doing a test against null

Drawing semantic line in the sand... all generated errors are caught
and reported but ultimate return value is given to caller.  Null if
something is not right, otherwise the userinfo.
But NOT propagating errors through the stack possibly triggering a
security break down.

(and yes, still scrubbing the hell outta the url)

ncaripsl/esgf-security,ncaripsl/esgf-security,ncaripsl/esgf-security