Just to cover edge cases when sessions are about to expire.

Makes the authentication cookie quite shorter.

This prevents an error where the keystore will have invalid keys even
in presence of a valid SSO ticket (because the parent auth session has
expired already).

This avoids browsers messing up the session state (given that /login
calls session.Reset) with requests to various kinds of well-known URLs
that might not exist.

Also add an integration test for a server with non-nil URL prefix.

Fix a pretty fundamental error where group memberships could not be
verified. Also adds tests to ensure this does not happen again.

Refactor the login handler

See merge request !6

Session handling no longer depends on gorilla/sessions.

Drop gorilla/sessions in favor of using gorilla/securecookie
directly (we use a single cookie anyway). Since securecookie already
has its own expiration timestamp, we can drop some stuff from httputil
as well.

There is no need for the complex gorilla/sessions machinery for what
is basically a single cookie, so we switch to using
gorilla/securecookie directly.

There is no point in using the complex gorilla/sessions machinery for
storing a simple long-term cookie, just use gorilla/securecookie directly.

If we don't, they will trigger the login handler and invalidate the
current session (if any), which prevents the user from being able to
log in.

Being consistent across runs avoids generating spurious git changes.

Fix a bug where global variables were missing.

Remove the build-time dependency on Python, the sri_map is now
generated via a small Go script.

The login handler is now a simpler, standalone http.Handler
wrapper. The separation between the SSO application and the login
handler is now fairly complete.

The login handler no longer forces the user to a specific workflow via
session cookies, but it works on a request-by-request basis instead,
which makes the "back" button works as expected (allowing the user to
bail out of a broken 2FA process, for example).

Session handling has been simplified as well: there is a single
session for authentication and login state, which should remove the
opportunity for session synchronization errors.