Spiked out CSRF anti-forgery protection: works but needs tests, and broke other tests.  Updated and made tests more robust.  Tweaked a lot of code to be a bit more idiomatic.
Refactored tests primarily. Uses dummy app now rather than calling workflow function directly. Full tests authentication flow from start to finish.
removes extraneous println, README updates.