processAssertion now returns identityIssuer
wrap cookie contents in Cookie type
rename createSessionCookie() to sendSignedCookie()
use Cookie struct to wrap sending
cookie and request now include issuer, and require logic checks it
document persona-idp Require option
Merge branch 'require-idp': check IdP against assertion issuer

The issuer is now also part of the cookie value.