Don't verify the authenticity token on session create

This causes issues with the developer omniauth strategy, and probably 
isn't the right behaviour when a service redirects back to the app.
Move from secret_token to secret_key_base
Exclude a .env file from git
Change protect_from_forgery to raise an exception
Set the user id explicitly in the session

Rather than using Warden's helpers to set and retrieve the user ID, set 
it directly in the SessionsController. This will make it easier to 
remove Warden in a later commit.
Switch to using Google authentication

This removes the opensesame-github library and Omniauth strategy,
replacing it with the omniauth-google-oauth2 library.

The User table has been significantly changed to support more general-
purpose fields which are not specific to a single provider.
Make the ApplicationHelper module methods private
Update the User factory to support the new attributes
Don't use the developer strategy in test
Update the integration tests to stub Omniauth flow
Add tests for building a User from an auth hash
Only allow users emails from a hostname whitelist
Fix integration test helper
Merge pull request #14 from JordanHatch/google-auth

Switch to using Google Auth