some WSGI-no-more related cleanups
more cleanups
Store authn_ref locally.

Avoid storing authn_ref in the idpauthn cookie, to prevent
'upgrade' attacks.
Major breakup of idp.py.
cleanup and comments
geturl: ensure single slash before path