- This may seems silly but the functionality is shared
between oauth2 and auth with no changes so it makes it nicer
not to have an oauth2/logout route like before
- Change changelog format to use keepachangelog standard
- Refactor the config to be made of substructs to help organize all the
pieces
- Add the new interfaces to the configuration
- Clean up module loading (no unnecessary reflection to create new value)
- Change User interface to have a Get/SetPID not E-mail/Username, this
way we don't ever have to refer to one or the other, we just always
assume pid. In the case of Confirm/Recover we'll have to make a GetEmail
or there won't be a way for us to get the e-mail to send to.
- Delete the xsrf nonsense in the core
- Re-add the age-old "Values" from the Context. This was originally
there for exactly the documented purpose. However the Context holding
the request form values negated it's use. It's back because of this
new separation.
- Make the auth success path set the authboss.CookieRemember value in
the context before calling it's callback.
- Stop logged in users from accessing pages like auth/recover etc.
- Ensure that half-authed users are allowed access to auth-like pages.
- Make sure that if users have a remember token, it's processed before
we decide if a user is logged in or not, preventing or granting access
to these pages.
- Fix#58
- Having the default logger set to nil was troublesome because some errors
are hard to detect without a logger. This falls under "sane default"
changes and so should be made.
