update AppEngine SDK and guava
automatically redirect to login page
simply sign the auth cookie, no need to encrypt
storing the cookie creation time in the cookie instead of the expiration time
assert correct token count when de-serializing auth cookie
updated guice from 3 to 4 beta
use proper joda time package in AuthHelper
switch from requireExplicitBindings to requireAtInjectOnConstructors at add missing @Inject annotations