support return_to and other cleanup

everything seems to be working. all another service needs to do
to get the /v1/current_user endpoint to work is to make a request
similar to the following:

curl 'http://auth.mayone.us/v1/current_user
  ?return_to=https://service.mayone.us/something'
  -H 'Cookie: auth="eyJfdXNlciI6WzU2Mj...cf58ec99cb3"'

the returned json will either include the logged-in user's data, or,
in the case of a missing or expired auth cookie, a list of services
with associated login links that, on login, return to the provided
return_to url.