Enforce timeout on deserialization not hook

* Don't invoke failure app and redirect on non-authenticating requests
* No special handling required for interoperation with rememberable
* Version bump to 0.2.0