Fix StatusResponse when return_addrs is not set

`return_addrs` is set to `None` by default in `StatusResponse.__init__()`.
If it is not filled with a proper value then `self._verify()` will fail because it tries
to iterate over a `None` object.

This PR avoids this error, by setting the `return_addrs` to `[]`.

```
if self.asynchop:
    if (
        self.response.destination
        and self.response.destination not in self.return_addrs
    ):
        logger.error("%s not in %s", self.response.destination, self.return_addrs)
        return None
```

Signed-off-by: Ivan Kanakarakis <[email protected]>

Author: peppelinux

src/saml2/response.py

@@ -255,7 +255,7 @@ class StatusResponse(object):
     def __init__(self, sec_context, return_addrs=None, timeslack=0,
             request_id=0, asynchop=True, conv_info=None):
         self.sec = sec_context
-        self.return_addrs = return_addrs
+        self.return_addrs = return_addrs or []
 
         self.timeslack = timeslack
         self.request_id = request_id
@@ -402,10 +402,11 @@ def _verify(self):
                 raise RequestVersionTooHigh()
 
         if self.asynchop:
-            if self.response.destination and \
-                            self.response.destination not in self.return_addrs:
-                logger.error("%s not in %s", self.response.destination,
-                             self.return_addrs)
+            if (
+                self.response.destination
+                and self.response.destination not in self.return_addrs
+            ):
+                logger.error("%s not in %s", self.response.destination, self.return_addrs)
                 return None
 
         valid = self.issue_instant_ok() and self.status_ok()