Log all exceptions from handlers as critical errors.  (Preparing to abandon package Response.Not_Cached.)
Register all OpenID log-in attempts.
No point in failing completely, just because the user is authenticated, but not authorised.
Allow any parameters to '/users/validate', but log all parameters passed to the interface.
Merge branch 'master' of https://github.com/sparre/Alice into sparre