Major security fix (numerous bugs, which were not noticed because the response of validate() is currently not being checked)

... because it was being generated incorrectly before (using steamcommunity.com as the trust_root). return value from validate() function is now checked, rather than calling function and ignoring the response. return_url arg makes manual setting of return_url and realm in setup unneeded. Without providing return_url in the constructor, the current (incorrect) behavior of sending the current uri as the return_url will persist, which will always fail unless login uri and return uri are the same.