various fixes for getting Nginx auth_request mode working

This is useful in Nginx auth_request mode, if a 401 handler is
configured to redirect to the sign-in page. As the request URL
does not reflect the actual URL, the value is taken from the
header "X-Auth-Request-Redirect" instead. Based on #247

This is enhancement of #173 to use "Auth Request" consistently in
the command-line option, configuration file and response headers.
It always sets the X-Auth-Request-User response header and if the
email is available, sets X-Auth-Request-Email as well.

Option to skip SSL verification

travis: run gofmt and go vet

CSRF protection for OAuth flow.

Allow to pass user headers only

Oversize Cookie Alert

Skip 404 errors when looking up Google groups

Improve redirect checks

When checking user membership against Google groups the groups are checked one
at a time and in the order that they were supplied. If one of the groups does
not exist then the checking is halted with the following error.

google.go:201: googleapi: Error 404: Resource Not Found: groupKey, notFound

None of the groups following the missing group are checked either. This means
that something as trivial as a typo in the first group will make it impossible
for anybody to login.

This change catches the 404, logs a message, and then carries on as usual. In
this way a typo will cause a particular group to stop working but will not
affect any other groups.

Update vendored dependencies.

This fixes a test w request signing due to a content-length:0 header from Go 1.8

dist.sh and Godeps updates

golang.org/x/oauth2/google is same repo as golang.org/x/oauth2
  - this sometimes confused gpm/git

cloud.google.com/go/compute/metadata is a missing dependency
of golang.org/x/oauth2

so gpm is not affected if module exists in user's GOPATH already

dist.sh: add .exe for windows build

[signout] Implement logout endpoint

Cookies cannot be larger than 4kb

* This fixes https://github.com/bitly/oauth2_proxy/issues/205
* Add new boolean option -pass-user-headers
  to control whether X-Forwarded-User and X-Forwarded-Email
  headers will be set (as opposed to HTTP BASIC auth)
* This is required e.g. for grafana [1] where
  X-Forwarded-User is needed but HTTP BASIC auth fails
  (password is not known and must not be known in this scenario)
* Keep behaviour of PassBasicAuth unchanged for compatibility

[1] http://docs.grafana.org/installation/configuration/#authproxy

Correct the spelling of GitHub in README

repo golang.org/x/oauth2/google has moved, fixes travis build

this fixes the travis build, which is broken

Strip sensitive URL parameters from provider log output

Adding skip-provider-button docs