Making root application secure: always

This is so it can properly load and make API calls, which require https (and use protocol relative // in the application).
Changing auth to use Google+ sign-in.

Reviewed in https://codereview.appspot.com/10574043/
Use email from ID token instead of calling userinfo API.

Reviewed in https://codereview.appspot.com/10641043/
Adding note about security/validity of ID token parser.
fix syntax; fix idToken parsing
Merge pull request #8 from d2m/master

Syntax fix and bad reference fix.
Update README to reference client ID in render.js instead of base.js.