Refactor the login handler

The login handler is now a simpler, standalone http.Handler wrapper. The separation between the SSO application and the login handler is now fairly complete.

The login handler no longer forces the user to a specific workflow via session cookies, but it works on a request-by-request basis instead, which makes the "back" button works as expected (allowing the user to bail out of a broken 2FA process, for example).

Session handling has been simplified as well: there is a single session for authentication and login state, which should remove the opportunity for session synchronization errors.

httputil/renderer.go

@@ -45,7 +45,7 @@ func (r *Renderer) Render(w http.ResponseWriter, req *http.Request, templateName
 	// Render the template into a buffer, to prevent returning
 	// half-rendered templates when there is an error.
 	var buf bytes.Buffer
-	if err := r.tpl.ExecuteTemplate(&buf, templateName, data); err != nil {
+	if err := r.tpl.ExecuteTemplate(&buf, templateName, vars); err != nil {
 		log.Printf("template rendering error for %s: %v", req.URL.String(), err)
 		http.Error(w, err.Error(), http.StatusInternalServerError)
 		return