Documentation: fix typo

Bundlder => Bundler
Config/Apache: misc fixes (Proxy, Headers, Logs)

Several fixes for the sample Apache config rapidconnect.conf
* Exclude Shibboleth-SP URLs from the ProxyPass directive
* Remove erroneous /idp from ProxyPass target
* Add ShibUseHeaders On as needed by unicorn behind HTTP proxy
* Rename log files from groups_* to rapid_* (copy-edit?)
Config/SP: add SAML2 OID mapping for O and OU

Provide also a SAML2 OID mapping for O and OU (they've been so far
mapped only with SAML1 URN attribute names).
Mail: use settings.hostname in notification emails
Views: change remaining AAF Fuse to RapidConnect

Change remaining references to AAF Fuse to AAF RapidConnect.
Cookie: use secure cookie in production deployment

Pass "secure: true" to Rack options in production environment to use
:secure session cookies.

Correspondingly, update Apache configuration so that Apache tells Racks
that the request has been forwarded from an SSL connection - add a
header:
   X-Forwarded-SSL: on
Cookie: use secure cookie only in production env

Make the use of secure cookie conditional on being in production
environment - as per comments in #11.
Merge pull request #11 from University-of-Auckland/develop-mic-fixes

Misc fixes for RapidConnect
Switch erb to escape HTML by default using Erubis

Guard against potential XSS and other nasties by users of Rapid Connect
Merge pull request #12 from ausaccessfed/feature/extra-xss-protection

Escape all variables inserted in HTML by default
Updated dependencies
Session: use memcached for session management

In preparation for Tuakiri deployment behind a load balancer in
active-hotstandby configuration, switch to managing sessions in
memcached (local to each host), keeping only service and administrator
configuration in redis.

Switching sessions to memcached could be done quite easily with:

  use Rack::Session::Memcache, expire_after: 3600, secure: Sinatra::Base.production?

Except this would apply the expire_after setting also to session
cookies - which would mean session cookies would not be tied to browser
session and sessions would persist a browser restart.

As Rack::Session::Memcache only checks expire_after, we can't use the
trick done for Redis sessions in
d11742215188aca639236eaafe41b41a0f8ada0b - passing expire_in instead,
which gets checked by Redis store for expiry on session records but not
by Rack::Session::Abstract::ID.

As both Rack::Session::Memcache and Rack::Session::Abstract::ID check
:expire_after only, the only solution to have the expire applied to
sessions stored in memcached (so that sessions do expire) but not to
session cookie (so that the cookie is instead tied to browser session)
was to override the set_session method in a subclass of
Rack::Session::Memcache.

That's why this commit is introducing RapidConnectMemcacheSession in
app/rcmcsession.rb loaded by app/rapid_connect.rb - and initializes the
class with:

use RapidConnectMemcacheSession, memcache_session_expiry: 3600, secure: Sinatra::Base.production?
Fix new violations from upgraded RuboCop
Always require spec_helper for RSpec runs

Saves having that require statement in every file.
Use `falsey` and `truthy` because RSpec 3.x

be_false and be_true are gone.
Install Guard and plugins
Add workaround for legacy RSpec matcher warnings
Upgrade .should matchers to new expectation style

`should` matchers are deprecated. We'll just take the once-off hit and
fix this.
Change mocks to use new style; stub is deprecated
Merge pull request #13 from ausaccessfed/feature/upgrade-to-rspec3

Upgrade dependencies and fix resulting deprecation warnings