code:     public void testEntityExpansionWReq() throws Exception {
          String url = "https://localhost:" + getIdpHttpsPort() + "/fediz-idp/federation?";
          url += "wa=wsignin1.0";
          url += "&whr=urn:org:apache:cxf:fediz:idp:realm-A";
          url += "&wtrealm=urn:org:apache:cxf:fediz:fedizhelloworld";
          String wreply = "https://localhost:" + getRpHttpsPort() + "/" + getServletContextName() + "/secure/fedservlet";
          url += "&wreply=" + wreply;
  
          InputStream is = this.getClass().getClassLoader().getResource("entity_wreq.xml").openStream();
          String entity = IOUtils.toString(is, "UTF-8");
          is.close();
          String validWreq =
              "<RequestSecurityToken xmlns=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512\">"
              + "<TokenType>&m;http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0</TokenType>"
              + "</RequestSecurityToken>";
  
          url += "&wreq=" + URLEncoder.encode(entity + validWreq, "UTF-8");
  
          String user = "alice";
          String password = "ecila";
  
          final WebClient webClient = new WebClient();
          webClient.getOptions().setUseInsecureSSL(true);
          webClient.getCredentialsProvider().setCredentials(
              new AuthScope("localhost", Integer.parseInt(getIdpHttpsPort())),
              new UsernamePasswordCredentials(user, password));
  
          webClient.getOptions().setJavaScriptEnabled(false);
          try {
              webClient.getPage(url);
              Assert.fail("Failure expected on a bad wreq value");
          } catch (FailingHttpStatusCodeException ex) {
              Assert.assertEquals(ex.getStatusCode(), 400);
          }
  
          webClient.close();
      }
  
      // Send an malformed wreq value
      @org.junit.Test
  