Add option to make `remember_token` cookie secure

This is important if you have an app running on HTTPS, otherwise the
auth cookie is leaked when you visit a HTTP URL and can be intercepted.

Read more:

* http://blog.teamtreehouse.com/how-to-create-totally-secure-cookies
* http://guides.rubyonrails.org/action_controller_overview.html

Also:

* Fix documentation of `Clearance::Backdoor` (was missing namespace).
Remove `unloadable` from controllers

They are causing circular dependencies in Rails 4 + Ruby 2:

https://github.com/thoughtbot/clearance/issues/276
Add `redirect_url` config option

* Clarify in README that the config example shows the default values.
* Wrap long line at 80 characters.
* Move `redirect_to_root` from `lib/clearance/authorization.rb` to where
  it is used, in `app/controllers/clearance/sessions_controller.rb`, and
  better reveal its intent by re-naming it to `avoid_sign_in`.
* Re-set `config.secure_cookie` to its original value in an `after`
  block in a test to teardown and avoid leakage across tests.
* Use `_url` suffix in config name to match [RFC 2616 spec, section 14.
  14.30](http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.30),
  which states the Location response-header field should use an absolute
  URI for 3xx responses.
* The default value for `redirect_url` is the string path `'/'` as a
  previous compromise to make it less likely users will run into an
  issue if they don't want to define a root route. The string value avoids
  potentially confusing `NoMethodError: undefined method 'root_url'`
  errors.

https://github.com/thoughtbot/clearance/pull/281
Bump to 1.0.0.rc7
Add documentation for `config.redirect_url`
Ignore hostnames in return_to

* Extracts the path from return_to URLs
* Prevents malicious offsite redirects from phishing links

See unresolved issue 5 from:
http://blog.codeclimate.com/blog/2013/03/27/rails-insecure-defaults/