Fix Authenticate() race - fixes #26

  * Hold authLock when Reading or writing to StorageUrl, AuthToken and Auth
  * Call() merges calls to Authenticate() if run concurrently
  * Fix the various race conditions in the tests
  * The code now runs clean on `go test -race -v`.
Document methods are safe to use concurrently - fixes #23
Fix typo noticed by go vet