[github provider] use Authorization header, not access_token query parameter

README: nginx auth_request example updates

how to pass back the refreshed oauth2_proxy cookie from an nginx auth_request

/oauth2/auth is not more sensitive than other /oauth2/ paths,
does not need "internal" protection

"spdy" protocol is obsolete, http2 is the thing to enable now.
But it's orthogonal anyway.

No need for two separate content/upstream location blocks in
this example, reduce to just one, with a comment that it could
be serving files instead of proxying.

dist.sh: use go build option to strip binaries

30% release binary size reduction

Release v2.2

Fix url parse error

#369: Optionally allow skipping authentication for preflight requests

various fixes for getting Nginx auth_request mode working

This is useful in Nginx auth_request mode, if a 401 handler is
configured to redirect to the sign-in page. As the request URL
does not reflect the actual URL, the value is taken from the
header "X-Auth-Request-Redirect" instead. Based on #247

This is enhancement of #173 to use "Auth Request" consistently in
the command-line option, configuration file and response headers.
It always sets the X-Auth-Request-User response header and if the
email is available, sets X-Auth-Request-Email as well.

Option to skip SSL verification

travis: run gofmt and go vet

CSRF protection for OAuth flow.

Allow to pass user headers only

Oversize Cookie Alert

Skip 404 errors when looking up Google groups

Improve redirect checks

When checking user membership against Google groups the groups are checked one
at a time and in the order that they were supplied. If one of the groups does
not exist then the checking is halted with the following error.

google.go:201: googleapi: Error 404: Resource Not Found: groupKey, notFound

None of the groups following the missing group are checked either. This means
that something as trivial as a typo in the first group will make it impossible
for anybody to login.

This change catches the 404, logs a message, and then carries on as usual. In
this way a typo will cause a particular group to stop working but will not
affect any other groups.

Update vendored dependencies.

This fixes a test w request signing due to a content-length:0 header from Go 1.8

dist.sh and Godeps updates

golang.org/x/oauth2/google is same repo as golang.org/x/oauth2
  - this sometimes confused gpm/git

cloud.google.com/go/compute/metadata is a missing dependency
of golang.org/x/oauth2

so gpm is not affected if module exists in user's GOPATH already