Just serve an error on the logout page if there is no valid session,
instead of redirecting to the login workflow.

Fixes issue #8.

Fixes issue #6.

And standardize on a single structure for the gorilla session
map, using the 'data' key for our gob-encoded objects.

Using the new configuration variable 'keystore_enable_groups'.

Likely fixes issue #7 (untested).

Without this field, U2F just isn't working and the accounts with U2F
set up are shown an OTP prompt.

There seems to be no good reason to change group membership when
exchanging tokens, let's try just passing the old one over.