Persona

Mozilla's Persona (previously called BrowserID) is pretty nice. I've
added support for it.

The middleware intercepts request that have the `X-Hails-Persona-Login`
and `X-Hails-Persona-Logout` headers.  If login, the middleware verifies
the assertion with Mozilla's server and if successful sets cookie
`_hails_user` to the email address `_hails_user_hmac` to its HMAC-SHA1.
If logout, the middleware just deletes the cookies.  If no header is
matched the cookies are checked and X-Hails-User is sef.

If the app sets the `X-Halis-Login` we usually redirect to the login
page of the authentication service. In this case, we redirect to
`/login`where the app is assumed to use Persona's js lib to start the
authentication procedure