rename Signature to HMAC, since that's what it is.
Add a HMAC implementation based on top of APR's SHA1.

No unit-tests yet, but conforms to the HMAC-SHA1 Spec
Use constants for the digest size instead of hard-coding things
enable adding JS code to signin page
process assertions even if a valid cookie is present
fire watch() from window.onload() to allow for some preparation
show error if authorization failed (403 Forbidden)
Merge pull request #20 from mozilla/dynamic-page

show error page and allow relogin after failed authorization (fixes #13)
processAssertion now returns identityIssuer
wrap cookie contents in Cookie type
rename createSessionCookie() to sendSignedCookie()
use Cookie struct to wrap sending
cookie and request now include issuer, and require logic checks it
document persona-idp Require option
Merge branch 'require-idp': check IdP against assertion issuer

The issuer is now also part of the cookie value.
merge conflict
fix merge commit