Run gofmt over source

Add flag to enable/disable cookie's HttpOnly flag.

Support for multi white listed urls with regex url match.

Fix typo

Allow hiding custom login UI even if an htpasswd file is provided.

When loading client-id/client-secret/cookie-secret from env variables, google_auth_proxy blows up.

1.0 release

Better environment variable parsing

add option/flag to specify config file in place of commandline options

Better (mobile) sign in template

Use of secure attribute in cookies

Handle upstreams without a trailing slash

- Changed from using string == to hmac.Equal
- See more details here: http://verboselogging.com/2012/08/20/a-timing-attack-in-action

Pass in the original email address too as X-Forwarded-Email.

Add /ping endpoint

/v2/userinfo going away, switch to new scopes and id token payload

Make it looks a little better in mobile browsers