Handle upstreams without a trailing slash
Fixed timing attack in cookie validation.

- Changed from using string == to hmac.Equal
- See more details here: http://verboselogging.com/2012/08/20/a-timing-attack-in-action
Merge pull request #22 from dbrgn/empty_upstream_path

Handle upstreams without a trailing slash
Added cookie settings
always set httponly (there is no good reason not to); simplify httponly and expire flags
Merge pull request #34 from jehiah/secure_cookies_34

Use of secure attribute in cookies
pretty styling of sign in page
Merge pull request #36 from jehiah/better_templates_36

Better (mobile) sign in template
Add config file support
Merge pull request #20 from jehiah/config_support_20

add option/flag to specify config file in place of commandline options
better environment parsing
Merge pull request #37 from jehiah/env_parsing_37

Better environment variable parsing