correct debian/changelog line length
prevent JWE timing attacks on CEK; add JWE test
check for open redirect on passed target_link_uri
add note on restricting access to specific Google Apps domain(s)