Apps can hook in their own locator.

Move only resctriction to locator.

Memoize default locator. Privatize class methods properly.

Make app name validating public.

Use app validation on GlobalID.

Normalize app names when reading or setting locators.
Merge pull request #15 from kaspth/app-locater

Apps can hook in their own locator.
signing with purpose via :for option

override == in SignedGlobalID to consider purpose

change serializer to JSON and clear the tests