travis: run gofmt and go vet

CSRF protection for OAuth flow.

Allow to pass user headers only

Oversize Cookie Alert

Skip 404 errors when looking up Google groups

Improve redirect checks

When checking user membership against Google groups the groups are checked one
at a time and in the order that they were supplied. If one of the groups does
not exist then the checking is halted with the following error.

google.go:201: googleapi: Error 404: Resource Not Found: groupKey, notFound

None of the groups following the missing group are checked either. This means
that something as trivial as a typo in the first group will make it impossible
for anybody to login.

This change catches the 404, logs a message, and then carries on as usual. In
this way a typo will cause a particular group to stop working but will not
affect any other groups.

Update vendored dependencies.

This fixes a test w request signing due to a content-length:0 header from Go 1.8

dist.sh and Godeps updates

golang.org/x/oauth2/google is same repo as golang.org/x/oauth2
  - this sometimes confused gpm/git

cloud.google.com/go/compute/metadata is a missing dependency
of golang.org/x/oauth2

so gpm is not affected if module exists in user's GOPATH already

dist.sh: add .exe for windows build

[signout] Implement logout endpoint

Cookies cannot be larger than 4kb

* This fixes https://github.com/bitly/oauth2_proxy/issues/205
* Add new boolean option -pass-user-headers
  to control whether X-Forwarded-User and X-Forwarded-Email
  headers will be set (as opposed to HTTP BASIC auth)
* This is required e.g. for grafana [1] where
  X-Forwarded-User is needed but HTTP BASIC auth fails
  (password is not known and must not be known in this scenario)
* Keep behaviour of PassBasicAuth unchanged for compatibility

[1] http://docs.grafana.org/installation/configuration/#authproxy

Correct the spelling of GitHub in README

repo golang.org/x/oauth2/google has moved, fixes travis build

this fixes the travis build, which is broken

Strip sensitive URL parameters from provider log output

Adding skip-provider-button docs

Bump travis version

Validate cookie name passes go's isCookieNameValid check

Getting mail for Azure provider fix + tests