Fix openssl warning for decipher input encoding.
updated version num
nevermind, cookie breakage, uping version number by a lot
tighten up documentation
allow the client to specify a different request key name rather than forcing them to use the cookie name - issue #43
version 0.3.1
Add a (failing) test for tampered HMACs

The test input conveniently chosen so that the HMAC (mis-)interpreted as UTF-8
gives REPLACEMENT CHARACTER (U+FFFD) at the end.
Check HMACs better

Makes the previous test pass. The previous version incorrectly treated the HMAC
as a UTF-8 which loses bits to replacement characters. Also, make some attempt
to check it in constant-time. Ideally node would provide a native
implementation less sensitive to the JS implementation.
Fix node 0.8 HMAC code

In 0.8, crypto returns binary-encoded strings for a lot of operations. This
normalizes everything to Buffers and fixes some type confusion. Previously,
node 0.8 encoded HMACs as
  base64(encodeUTF8(pretendEachByteIsUnicodeCodePoint(hmac)))
and checked them correctly, while node 0.10 encoded HMACs as
  base64(hmac)
but checked them incorrectly.
test: add another session duration test

We test that the session is cleared after it expires, but we don't
check that it's still there just before it expires, at least not in
the same way.
Always set the HTTP expiry on the cookie to match internal duration

The external expiry on the cookie (which is really just a suggestion
for the browser) should be the same as the expiry inside the
encrypted/signed payload. That way the browser will avoid sending
an invalid cookie to the server.

https://github.com/mozilla/browserid/issues/2754
test: remove lies in comments

Perhaps the internal duration was 400 ms in a former life, but
now it's set to 500.
Update the cookie expiry whenever duration or createdAt change

The cookie is reset everytime something in the session payload
changes. Whenever its reset, the original value of expires is
used.

This is good unless the duration or the creation time change. In
that case, we need to also update the cookie expiry to match the
expiry of the signed payload.
README: document existing cookie.maxAge property
Add new cookie.ephemeral option defaulting to false

This option ensures that the cookie is expired by the browser when
it closes. It used to be the default but this was changed in
a2b144ccf7399451c338130bcd72cfc193635614.
Ephemeral state can now be changed in setDuration

Changing the ephemeral state will cause a new cookie to be set in
the browser.