Added a confirmation code to auto_login URL to fix bug where anyone can login as anyone.
Merge pull request #101 from gbuckingham89/master

Good catch. I'll adjust it slightly using SEP instead of & in URLs... Fix for security issue that means the entire login process can be bypassed