Proxied requests use the upstream Host as Host Header

Catch more options errors at once; add test

Added scheme parsing to http-address param

Can now listen for HTTP clients on unix sockets (and any other Go-supported stream oriented network - see golang.org/pkg/net/#Listen).  Default behaviour is unchanged, any http-address without a scheme is given the default of tcp.

Amended the README so that the usage output is up to date.

Run gofmt over source

Add flag to enable/disable cookie's HttpOnly flag.

Support for multi white listed urls with regex url match.

Fix typo

Allow hiding custom login UI even if an htpasswd file is provided.

When loading client-id/client-secret/cookie-secret from env variables, google_auth_proxy blows up.

1.0 release

Better environment variable parsing

add option/flag to specify config file in place of commandline options

Better (mobile) sign in template

Use of secure attribute in cookies

Handle upstreams without a trailing slash

- Changed from using string == to hmac.Equal
- See more details here: http://verboselogging.com/2012/08/20/a-timing-attack-in-action