Refactor the login handler

The login handler is now a simpler, standalone http.Handler wrapper. The separation between the SSO application and the login handler is now fairly complete.

The login handler no longer forces the user to a specific workflow via session cookies, but it works on a request-by-request basis instead, which makes the "back" button works as expected (allowing the user to bail out of a broken 2FA process, for example).

Session handling has been simplified as well: there is a single session for authentication and login state, which should remove the opportunity for session synchronization errors.

server/http.go

@@ -17,7 +17,6 @@ import (
 
 	assetfs "github.com/elazarl/go-bindata-assetfs"
 	"github.com/gorilla/csrf"
-	"github.com/gorilla/mux"
 	"github.com/rs/cors"
 
 	"git.autistici.org/id/auth"
@@ -99,14 +98,11 @@ func New(loginService *LoginService, authClient authclient.Client, config *Confi
 		return nil, err
 	}
 
-	// The root HTTP handler. This must be a gorilla/mux.Router since
-	// session handling depends on it.
-	//
-	// If a URL prefix is set, we can't just add a StripPrefix in
-	// front of everything, as the handlers need access to the
-	// actual full request URL, so we just inject the prefix
-	// everywhere.
-	root := mux.NewRouter()
+	// The root HTTP handler. If a URL prefix is set, we can't
+	// just add a StripPrefix in front of everything, as the
+	// handlers need access to the actual full request URL, so we
+	// just inject the prefix everywhere.
+	root := http.NewServeMux()
 
 	// If we have customized content, serve it from well-known URLs.
 	if config.SiteLogo != "" {
@@ -133,7 +129,7 @@ func New(loginService *LoginService, authClient authclient.Client, config *Confi
 
 	// Serve static content to anyone.
 	staticPath := h.urlFor("/static/")
-	root.PathPrefix(staticPath).Handler(http.StripPrefix(staticPath, http.FileServer(&assetfs.AssetFS{
+	root.Handle(staticPath, http.StripPrefix(staticPath, http.FileServer(&assetfs.AssetFS{
 		Asset:     Asset,
 		AssetDir:  AssetDir,
 		AssetInfo: AssetInfo,
@@ -171,7 +167,7 @@ func New(loginService *LoginService, authClient authclient.Client, config *Confi
 	})
 	apph = corsp.Handler(apph)
 
-	root.PathPrefix(h.urlFor("/")).Handler(apph)
+	root.Handle(h.urlFor("/"), apph)
 	h.handler = root
 
 	return h, nil