don't break authn where AuthType != Persona (fixes #24)

Try to not to spew debug in the non-Persona case, either.
Add a HMAC implementation based on top of APR's SHA1.

No unit-tests yet, but conforms to the HMAC-SHA1 Spec
false security is false, might as well return void
get rid of APRX prefix
Merge pull request #21 from gene1wood/master

fix typo in README, add example for 'Require user'
Merge branch 'hmac' (see issue #17).
set custom error response content for 401/403 errors
let people through as the default authorization policy

Decline authorization authority when there are no relevant Require lines.
clean up unneccessary Require line handlers

These generic directives can be handled by other Apache modules. Less code!
require POST method for login (see #10)
use error UX instead of alert()
implement logout via XHR (POST "null" assertion, fixes #15)
update to latest reqwest (with explicit version!)
rename to mod_authnz_persona everywhere (fixes #18)
show normal 403 error for persona-idp mismatches

Seems like enough information for users, and slightly better for security. It
also seems like this is hard to do in Apache 2.4's new AAA framework.
make things work with apache-2.4
language/typo fixes in comments/README
try to improve comments a bit
reflow README to 80 columns, fix interpunction/capitalization
remove obsolete XXX comment