[Resolves #390]

Use read_user as default scope for GitLab

*: add an OpenID Connect provider

See the README for usage with Dex or any other OIDC provider.

To test run a backend:

    python3 -m http.server

Run dex and modify the example config with the proxy callback:

    go get github.com/coreos/dex/cmd/dex
    cd $GOPATH/src/github.com/coreos/dex
    sed -i.bak \
      's|http://127.0.0.1:5555/callback|http://127.0.0.1:5555/oauth2/callback|g' \
       examples/config-dev.yaml
    make
    ./bin/dex serve examples/config-dev.yaml

Then run the oauth2_proxy

    oauth2_proxy \
      --oidc-issuer-url http://127.0.0.1:5556/dex \
      --upstream http://localhost:8000 \
      --client-id example-app \
      --client-secret ZXhhbXBsZS1hcHAtc2VjcmV0 \
      --cookie-secret foo \
      --email-domain '*' \
      --http-address http://127.0.0.1:5555 \
      --redirect-url http://127.0.0.1:5555/oauth2/callback \
      --cookie-secure=false

Login with the username/password "admin@example.com:password"

nginx auth_request: fix -skip-provider-button

Updates README.md with svg badge

strip all tokens

gracefully report un-parsed upstream URL

Remove check for >0 upstreams

Update cookie generation to match base64 encoding

upstreamURL is a nil pointer if there is an error parsing --upstream

When used solely for auth_request there is no upstream.
Instead of forcing users to set a dummy upstream, remove
the check.

Current code is using URLEncoding but example was using the
standard RFC 4648 encoding. Switch to using the URL
encoding in the example as well.

Update Google Auth Provider instructions

Fix spelling mistake in docs

[github provider] use Authorization header, not access_token query parameter

README: nginx auth_request example updates

how to pass back the refreshed oauth2_proxy cookie from an nginx auth_request

/oauth2/auth is not more sensitive than other /oauth2/ paths,
does not need "internal" protection

"spdy" protocol is obsolete, http2 is the thing to enable now.
But it's orthogonal anyway.

No need for two separate content/upstream location blocks in
this example, reduce to just one, with a comment that it could
be serving files instead of proxying.

dist.sh: use go build option to strip binaries

30% release binary size reduction

Release v2.2

Fix url parse error

#369: Optionally allow skipping authentication for preflight requests

various fixes for getting Nginx auth_request mode working