allow setting of user/password to authorize (other than using 'code').
refactor to user session.auth and rename 'username' argument
removed ()
Merge pull request #9 from yuhanz/master

allow setting of user/password to authorize (other than using 'code').