move ensureAuthenticated() middleware into authauth package
add README.md
improve usability by using email rather than OpenID identifier for whitelist
show useful information for failed attempt to log in