improvements (IP restrictions, email domain auth, and X-Remote-User header)

add support for IP restrictions on sessions, to prevent hijacking. also allow authentication by email domain instead of specific email addresses, and allow ability to set the protocol of the auth domain

one other change, sends X-Remote-User header back to nginx, incase you want to pass it to your downstream application.