OpenID API fixes & usability improvements.

Update usso dependency to support OpenID.
Added a simple example OpenID webapp.
Improvements to common OpenID support:
 - Get OpenID user info from callback with handler function.
 - Fixed callback parameter parsing.
 - Redirects use original scheme, so HTTPS is supported.
 - Improved error handling.
SchemeAuthenticator.Callback now provides User struct and raw OpenID
values to the web application. Updated Ubuntu SSO provider accordingly.
Improved godoc comments.
Flipped conditional check for != nil.
OpenID configuration options, usso constructors.

Made OpenID integration more configurable by introducing a shared
context struct for OpenID. This will allow use of more advanced storage
backends for managing the auth protocol and avoid memory leaks at scale.

Made protocol scheme ("http" or "https") a constructor arg to OpenID and Usso
scheme as these cannot be inferred from the http.Request (as far as I
can tell).

Made token a constructor arg as well to allow different services to
uniquely identify themselves. Endpoint as well as service name should be
factors in selecting a token name.

Hex-encoding the cookie name as it should be based on the token but some
characters break the cookie format. This could probably use improvement.

Added OpenID web-based and OAuth command-line based constructors for
UssoScheme, logic to handle the different capabilities of each. Prevent
a web server to prompt a terminal for a password, etc.
Split out rbac package, implement RFC 2617 auth.

Relocated role-based access control APIs to the rbac package,
trying to reduce dependencies of the top-level package, which I'd
like to only contain types and interfaces common to identity & auth.

Following HTTP authentication standards for Authorization: request
and WWW-Authenticate: response headers. Add helpers to auto-negotiate
these between the client and server.
Improve test coverage, find & fix bugs.

Improved test coverage of base functions and methods,
client auth store.

ParseUser now splits on the first, rather than last colon for
determining scheme portion.

Returning proper "not found" error type in FileAuthStore.Get.
Fixed token path for FileAuthStore.Set.
Fix client.WantsAuth, add test coverage.
Remove http scheme argument, force HTTPS.

Also fixed openid-demo to actually parse flags, serve TLS.
Add TLS redirect to demo, example cert creation.
Refactor schemes into token, handshake & common.

Want to be able to authenticate http.Request on the server side using a
common interface for both token-based (standalone OAuth 1) and handshake-based
(OpenID, OAuth 2, etc.) authentication providers. Refactored the scheme
interfaces into a common interface, then extending into TokenScheme for
creating and validating tokens, and HandshakeScheme for negotiating an
authenticated session in a web application.

Making handshake SignIn an explicit method to be called by the service,
as well as the Authenticated callback.

Migrated OpenID common handlers to create gorilla sessions. This has
flexibility of using different session storage backends. The demo uses
gorilla secure cookies.

Removed now-unnecessary callback stuff from OpenID API.
Fix session cookie issues. Logging in example.
Remove unused import.
Expose AuthServer.Schemes

As an alternative to redundant AuthServer.RegisterScheme.
Improve scheme API, godocs, error msg.

Moved PasswordPrompter to the usso TokenScheme constructor. It doesn't
necessarily fit in the base TokenScheme interface.
Test coverage for server, fix RFC 2617 auth.

Added unit tests for AuthServer.Authenticate using a mock TokenScheme.
Refactored out base TokenScheme.Authenticate implementation into common
function, use in mock & usso.

Fixed bugs in RFC 2617 Authorization: header checking, needed to
canonicalize the header key.

More TokenInfo godocs.