URLs whitelist

Allow people to specify an URL whitelist in the login config file.
I'm using this to specify URLs access without authentication, such as public API.
Update README.md

Update after `urlWhiteList` patch
Update session.js

Changed url white list name from `whiteList` to `urlWhiteList`
Bugs hunting

Resolved:
- logic bug in `if` statement
- resolved a bug in the `for` statement of `passUrlWhiteList`
- moved the check on the `options.urlWhiteList` existance inside `passUrlWhiteList` function
Merge pull request #10 from mattbrun/master

Allow URLs white list