Allow GithubService to limit access based on orgs.

- When creating the GithubService, accept an optional list of allowed organizations. If
  the user authenticates correctly, their organizations will then be checked against
  the allowed organizations. The user must be a member of one or more of the
  organizations in order to proceed. If the user is not in an allowed organization they
  are redirected to a forbidden page and no cookie is set.
Allow the forbidden path to be configured.

- forbidden_path can now be configured for a WSGIMiddleware object.
- Default forbidden page is ugly so also allow forbidden path to be passed through
  to the protected application so it can be styled properly.
Don't pass requests to app that are missing 'code'

- If a request is made to self.path with no 'code' parameter, don't pass the request
  to the application. Redirect to forbidden instead.
Add docstrings.
Add docs for `forbidden` params to WSGI.
Merge pull request #4 from secretmike/github-limit-to-organization

Add option to limit access based on Github Organizations