Moved auth out of extras
API Docs
Updated GoDoc from linting results
Update README.md
Use a secure comparison in auth middleware

Otherwise you might get timing attacks:

http://verboselogging.com/2012/08/20/a-timing-attack-in-action
Extract SecureCompare and check length instead

The padding method wasn't constant time, while I think this will be
Move util into ./auth.  tests are broken.