Add methods to the httpsso package to retrieve authentication info
from the current session (by passing an *http.Request object).

Compute the origin properly.

Using CORS-enabled requests in the background.

Panic on short reads and other errors.

The proxy wraps endpoints (exposed as separate HTTP hosts) with single-sign-on
authentication.