The correct endpoint is /oauth2/auth

* will not re-prompt if the email permission is denied, or if you previously authorized the same FB app without the email scope.

Google changed to developer console UI, updated walkthrough to match new UI.

Closes #152.

The path should be provided as a file:// url with the full operating system path.
An alias to where the directory is available as can be specified by appending
a fragment (ie. "#/static/") at the end of the URL.

By setting this to "force", certain providers, like Google,
will interject an additional prompt on every new session. With other values,
like "auto", this prompt is not forced upon the user.

*snicker*
*titter*
*giggle*

For tools that don't like empty passwords, this change allows
one to set a shared secret password for all users.

* bump version to 2.0
* remove --cookie-https-only option
* add windows build to dist.sh
* rename --cookie-key to --cookie-name

This adds a "*" option to --email-domain to disable email validation, and this renames `--google-apps-domain` to `--email-domain` for clarity across providers

This is accomplished by encoding the access_token in the auth cookie and
unpacking it as the X-Forwarded-Access-Token header for upstream requests.