add password_validation submodule
move valid_password? to core model
remove useless failing spec
fixes #582
remove password_validation shared_examples
feature/heroku_provider :: Heroku Oauth2 Provider, as per:
https://devcenter.heroku.com/articles/oauth#token-exchange
feature/expose_token :: Wanted to use sorcery as the authentication library with Oauth for external services, but needed to be able to access and store the user oauth token for use with other libraries, such as heroku's platform-api and github_api.

This commit does just that, by modifying get_user_hash to include the access_token token and refresh_token if present.  With a modified callback method on OauthsController, you can update the authentication to include the token and refresh token for later use:

  def callback
    provider = params[:provider]
    unless @user = login_from(provider)
      if @user = User.find_by_email(@user_hash[:email])
        @user.add_provider_to_user(provider, @user_hash[:uid])
      elsif current_user && @user = current_user
        current_user.add_provider_to_user(provider, @user_hash[:uid])
      elsif @user = create_from(provider)
        reset_session
      end
    end
    if @user
      Rails.logger.info @user_hash.inspect
      @user.send(provider).update_attributes(token: @user_hash[:token], refresh_token: @user_hash[:refresh_token])
      auto_login(@user)
      redirect_to root_path, :notice => "Logged in from #{provider.titleize}!"
    else
      redirect_to root_path, :alert => "Failed to login from #{provider.titleize}!"
    end
  end
feature/oauth_token :: Rename providers/base method from user_hash to auth_hash to avoid confusion. Add expires_at and expires_in to auth_hash.  Update all providers to use auth_hash method. Remove typo in Heroku documentation.
feature/oauth_token :: dup hash in providers/base auth_hash method so as to prevent mutation.
User.create_from_provider with empty password fix
Merge pull request #638 from Borzik/db_password_fix

User.create_from_provider with empty password fix
Merge pull request #630 from tyrauber/feature/oauth_token

@user_hash token and refresh_token
Do not copy auth hash if there is no need

If `access_token` is nil, we do not want to modify the hash, therefore there's
no need to copy it
Merge pull request #593 from palkan/feature-password-verify

add password_validation submodule