Extract auth_request? checking
Synchronize sessions across properties by preventing session_nonce mismatches

Scenario 1:

- User logs into property A
- User visits property B
The user gets automatically logged into B with the same account used on A

Scenario 2:

- User logs into property A with account X
- User visits property B (as seen above, gets logged into B with account X)
- User logs out from B and logs into B with a different account Y
- User visits property A
The user gets automatically logged into A with the account Y (the previous session corresponding to account X gets closed)

Scenario 3:

- User logs into property A
- User visits property B (as seen above, gets logged into B with account X)
- User logs out from property B
- User visits property A
The user gets automatically logged out from property A too
Make the "sync sessions" feature optional under a `session_sync_nonce` config option
Added optional support to allow certain anonymous requests via `allow_anonymous`.

Examples:

allow_anonymous: lambda { |_| true }

allow_anonymous: lambda { |req| !/\A\/admin/.match(req.fullpath) }

allow_anonymous: lambda { |req| req.fullpath == '/' }
Support optional `return_to` param to redirect after /auth/sso-logout
Added /auth/login which recognizes an optional `return_to` param.

The params indicates a different URL to be redirected after login. The existing `/auth/heroku` always redirects to `request.url`, which makes sense if the authentication is enforced but is not really flexible for other use cases.