Change documentation a little bit, and fix one bug.

auth/auth.go

@@ -1,3 +1,4 @@
+// Package auth implements password based user logins.
 package auth
 
 import (

confirm/confirm.go

@@ -1,4 +1,4 @@
-// Package confirm implements user confirming after N bad sign-in attempts.
+// Package confirm implements confirmation of user registration via e-mail
 package confirm
 
 import (

oauth2/oauth2.go

@@ -169,8 +169,9 @@ func oauthCallback(ctx *authboss.Context, w http.ResponseWriter, r *http.Request
 		return err
 	}
 
-	// Log user in
+	// Fully log user in
 	ctx.SessionStorer.Put(authboss.SessionKey, fmt.Sprintf("%s;%s", uid, provider))
+	ctx.SessionStorer.Del(authboss.SessionHalfAuthKey)
 
 	if err = authboss.Cfg.Callbacks.FireAfter(authboss.EventOAuth, ctx); err != nil {
 		return nil

recover/recover.go

@@ -1,3 +1,4 @@
+// Package recover implements password reset via e-mail.
 package recover
 
 import (

remember/remember.go

@@ -1,5 +1,5 @@
-// Package remember implements persistent logins through (typically) cookie session
-// storages. The SessionStorer implementation must be fully secure either over https
+// Package remember implements persistent logins through the cookie storer.
+// The ClientStorer implementation must be fully secure either over https
 // or using signed cookies or it is easily exploitable.
 package remember