Add support for a users whitelist

Fix lint warnings.

Remove certs from the agent when they expire

Added support for certificate lifetimes

update dependencies

Add AWS S3 and Google GCS virtual filesystems

Save oauth 'state' identifier in the client

This allows the signing key to be read directly from S3 using a path like
/s3/<bucket>/<path/to/signing.key> or /gcs/<bucket>/<path/to/signing.key>.

This switch statement doesn't do what I thought it does

Switch from json to hcl configs

This is backward-compatible with the JSON config format - this is a
non-breaking change.

HCL treats config blocks as repeated fields so the config has to be
unmarshalled into a struct comprised of []Server, []Auth, []SSH first.

client: use a config file in addition to command-line flags

Run more CI checks

Re-enable go 1.5
Run `go build`, `gofmt` and `go vet` in addition to tests.

To allow for easier development on localhost where one cannot get a
root-CA signed TLS certificate, add a new validate_tls_certificate
option to the configuration file which optionally allows for certificate
chain checking to be disabled.

Set expiry time in the github auth package

Add config.json to a gitignore to prevent it being versioned.

Don't allow wide-open Google or Github configs

Fail loudly if either the google_opts domain value or github_opts organization
values are not set in the configuration. The lack of these values means that
 a) in the Google case any @gmail.com address will be allowed
 b) the Github case any Github user will be allowed.

This was previously documented but left as a foot-gun in the code.

Future commits will allow for explicit wildcards to be set.