Closes #152.

The path should be provided as a file:// url with the full operating system path.
An alias to where the directory is available as can be specified by appending
a fragment (ie. "#/static/") at the end of the URL.

By setting this to "force", certain providers, like Google,
will interject an additional prompt on every new session. With other values,
like "auto", this prompt is not forced upon the user.

*snicker*
*titter*
*giggle*

For tools that don't like empty passwords, this change allows
one to set a shared secret password for all users.

* bump version to 2.0
* remove --cookie-https-only option
* add windows build to dist.sh
* rename --cookie-key to --cookie-name

This adds a "*" option to --email-domain to disable email validation, and this renames `--google-apps-domain` to `--email-domain` for clarity across providers

This is accomplished by encoding the access_token in the auth cookie and
unpacking it as the X-Forwarded-Access-Token header for upstream requests.

Can now listen for HTTP clients on unix sockets (and any other Go-supported stream oriented network - see golang.org/pkg/net/#Listen).  Default behaviour is unchanged, any http-address without a scheme is given the default of tcp.

Amended the README so that the usage output is up to date.

The Google Developers Console has a new interface and workflow. Updated the **OAuth Configuration** section with the correct steps, including a few notes on potential missteps.