Don't set the cookie domain to the host by default, as it breaks Cookie Prefixes

Swap out bmizerany/assert package in favor of stretchr/testify/assert

Clarify that GitHub team option in README

Add OpenID Connect provider name.

Drop deprecated MyUSA provider.

[Resolves #390]

Use read_user as default scope for GitLab

*: add an OpenID Connect provider

See the README for usage with Dex or any other OIDC provider.

To test run a backend:

    python3 -m http.server

Run dex and modify the example config with the proxy callback:

    go get github.com/coreos/dex/cmd/dex
    cd $GOPATH/src/github.com/coreos/dex
    sed -i.bak \
      's|http://127.0.0.1:5555/callback|http://127.0.0.1:5555/oauth2/callback|g' \
       examples/config-dev.yaml
    make
    ./bin/dex serve examples/config-dev.yaml

Then run the oauth2_proxy

    oauth2_proxy \
      --oidc-issuer-url http://127.0.0.1:5556/dex \
      --upstream http://localhost:8000 \
      --client-id example-app \
      --client-secret ZXhhbXBsZS1hcHAtc2VjcmV0 \
      --cookie-secret foo \
      --email-domain '*' \
      --http-address http://127.0.0.1:5555 \
      --redirect-url http://127.0.0.1:5555/oauth2/callback \
      --cookie-secure=false

Login with the username/password "admin@example.com:password"

nginx auth_request: fix -skip-provider-button

Updates README.md with svg badge

strip all tokens

gracefully report un-parsed upstream URL

Remove check for >0 upstreams

Update cookie generation to match base64 encoding

upstreamURL is a nil pointer if there is an error parsing --upstream

When used solely for auth_request there is no upstream.
Instead of forcing users to set a dummy upstream, remove
the check.

Current code is using URLEncoding but example was using the
standard RFC 4648 encoding. Switch to using the URL
encoding in the example as well.

Update Google Auth Provider instructions

Fix spelling mistake in docs

[github provider] use Authorization header, not access_token query parameter

README: nginx auth_request example updates

how to pass back the refreshed oauth2_proxy cookie from an nginx auth_request

/oauth2/auth is not more sensitive than other /oauth2/ paths,
does not need "internal" protection

"spdy" protocol is obsolete, http2 is the thing to enable now.
But it's orthogonal anyway.

No need for two separate content/upstream location blocks in
this example, reduce to just one, with a comment that it could
be serving files instead of proxying.

dist.sh: use go build option to strip binaries

30% release binary size reduction

The Cookie Prefixes spec disallows the use of the `domain` attribute in cookies
if the `__Host-` prefix is used
(https://tools.ietf.org/html/draft-ietf-httpbis-cookie-prefixes-00#section-3.2).

There's no need to set it to the host by default, so make it optional. If it is
set to a non-empty value, still output a warning if it is not a suffix of the
host, as that's likely not wanted.

Fixes #352.