Add PAPE extension support

I'd like to force Google Auth to reauthenticate if authentication is too old. This is available via a [PAPE extension to the OpenID standard](http://openid.net/specs/openid-provider-authentication-policy-extension-1_0.html), but not handled in rack-openid.

This PR adds both `preferred_auth_policies` and `max_authentication_age` via  `pape[preferred_auth_policies]` and `pape[max_authentication_age]` parameters respectively.