Found out the hard way that _incoming_ cookies do _not_ have their expiration
timestamps encoded. To perform auto-refresh based on expiration time, we have
to recalculate it from the time encoded in the cookie value.

cookie-refresh now no longer requires pass-access-token in order to work.

The intention is to refresh the cookie whenever the user accesses an
authenticated service with less than `cookie-refresh` time to go before the
cookie expires.

Add LinkedIn provider

Make address/domain comparisons case-insensitive

Refactor pass_access_token changes from #80

Extracts buildCookieValue() and parseCookieValue() from OauthProxy.ServeHTTP()
and adds tests for both.

Moves the check from NewOauthProxy() to Options.Validate() and adds a test.

Redirect to / when /oauth2/sign_in accessed

Without this change, clicking the sign-in button on /oauth2/sign_in will
always redirect back to /oauth2/sign_in, essentially creating an infinite
loop.

Pass the access token to the upstream server

This is accomplished by encoding the access_token in the auth cookie and
unpacking it as the X-Forwarded-Access-Token header for upstream requests.

This reflects the apparent intent of TestNewReverseProxy(). Without this
change, the test will fail when run without an Internet connection.

Add myusa provider

Add ProviderName field; use in sign_in template

Extract providers package

Extract api package