persist the session in a cookie, fixes #30
keep cookie values and session in sync
use static timeouts
the timeoutes aren't constants
0.0.7
nicer API docs link
fixed docs version
style
use strict
don't include authorization header in cross domain requests
check auth token presence first
better var names
added cross domain whitelisting
better spec wording
documentation for CORS
better name for the setting
added missing docs
fixed typo
clear password on login, see #29
fixed docs