Fix openssl warning for decipher input encoding.
fixing decipher encodings

input is binary, output is utf8

fixes #40
Merge pull request #41 from seanmonstar/deciper-encoding

fixing decipher encodings
Merge pull request #39 from yhahn/master

Fix openssl warning for decipher input encoding
updated version num
nevermind, cookie breakage, uping version number by a lot
tighten up documentation
Merge pull request #44 from mozilla/documentation-update

tighten up documentation
allow the client to specify a different request key name rather than forcing them to use the cookie name - issue #43
Merge pull request #45 from mozilla/43-override-request-key

allow the client to specify a different request key name rather than for...
version 0.3.1
make client-session self-aware

useful for mounting express apps, so that multiple uses of
client-sessions don't clobber each other.
Add a (failing) test for tampered HMACs

The test input conveniently chosen so that the HMAC (mis-)interpreted as UTF-8
gives REPLACEMENT CHARACTER (U+FFFD) at the end.
Check HMACs better

Makes the previous test pass. The previous version incorrectly treated the HMAC
as a UTF-8 which loses bits to replacement characters. Also, make some attempt
to check it in constant-time. Ideally node would provide a native
implementation less sensitive to the JS implementation.
Fix node 0.8 HMAC code

In 0.8, crypto returns binary-encoded strings for a lot of operations. This
normalizes everything to Buffers and fixes some type confusion. Previously,
node 0.8 encoded HMACs as
  base64(encodeUTF8(pretendEachByteIsUnicodeCodePoint(hmac)))
and checked them correctly, while node 0.10 encoded HMACs as
  base64(hmac)
but checked them incorrectly.
Merge pull request #48 from davidben/master

Fix UTF-8 confusion in HMAC check
test: add another session duration test

We test that the session is cleared after it expires, but we don't
check that it's still there just before it expires, at least not in
the same way.
Always set the HTTP expiry on the cookie to match internal duration

The external expiry on the cookie (which is really just a suggestion
for the browser) should be the same as the expiry inside the
encrypted/signed payload. That way the browser will avoid sending
an invalid cookie to the server.

https://github.com/mozilla/browserid/issues/2754
test: remove lies in comments

Perhaps the internal duration was 400 ms in a former life, but
now it's set to 500.
Merge pull request #55 from fmarier/matching_expiries

Matching expiries