LightOpenID constructor now takes an optional arg to provide return_url, because it was being generated incorrectly before (using steamcommunity.com as the trust_root). return value from validate() function is now checked, rather than calling function and ignoring the response. return_url arg makes manual setting of return_url and realm in setup unneeded. Without providing return_url in the constructor, the current (incorrect) behavior of sending the current uri as the return_url will persist, which will always fail unless login uri and return uri are the same.
Merge pull request #2 from dieselmachine/master

Major security fix (numerous bugs, which were not noticed because the response of validate() is currently not being checked)