Refactor the login handler

The login handler is now a simpler, standalone http.Handler wrapper. The separation between the SSO application and the login handler is now fairly complete.

The login handler no longer forces the user to a specific workflow via session cookies, but it works on a request-by-request basis instead, which makes the "back" button works as expected (allowing the user to bail out of a broken 2FA process, for example).

Session handling has been simplified as well: there is a single session for authentication and login state, which should remove the opportunity for session synchronization errors.

server/bindata.go

@@ -82,7 +82,7 @@ func staticCssBootstrapMinCss() (*asset, error) {
 var _staticCssSigninCss = []byte(`body {
   padding-top: 15%;
   padding-bottom: 20%;
-  background-color: #eee;
+  background-color: #efefef;
 }
 .form-signin {
   max-width: 330px;
@@ -117,6 +117,9 @@ var _staticCssSigninCss = []byte(`body {
   border-top-left-radius: 0;
   border-top-right-radius: 0;
 }
+.form-signin input[type="text"] {
+  margin-bottom: 10px;
+}
 .error {
   font-weight: bold;
   color: red;
@@ -147,7 +150,7 @@ func staticCssSigninCss() (*asset, error) {
 		return nil, err
 	}
 
-	info := bindataFileInfo{name: "static/css/signin.css", size: 1009, mode: os.FileMode(420), modTime: time.Unix(1535013418, 0)}
+	info := bindataFileInfo{name: "static/css/signin.css", size: 1071, mode: os.FileMode(420), modTime: time.Unix(1576447419, 0)}
 	a := &asset{bytes: bytes, info: info}
 	return a, nil
 }