Merge pull request #5 from reckart/master

Merge back from ShibHttpClient
Expose the AUTH_IN_PROGRESS string only to child (derived) classes:
Derived classes should let the parent class deal with processing, this
includes the authorisation process.
Sorry, made a mess in the comments.
Merge pull request #6 from spaetow/master

Expose the AUTH_IN_PROGRESS string only to child (derived) classes