Move templates and static under server/

Add a template for revocation

Use DATETIME type to store created/expires times

Require auth for the /admin and /revoke endpoints

Update whitelisting

Whitelist Google users based on their email address instead of the username part of the email address.
Plain gmail (non Google Apps) accounts don't necessarily end in '@gmail.com', and whitelisting on username alone is open to abuse.
Skip testing for a Google Apps domain (ui.Hd) if no domain is configured.
Principals will still be added as the user part of the email address.

For the Github provider, skip checking that the user is a member of an organization is none is configured.

Add support for a users whitelist

Fix lint warnings.

Remove certs from the agent when they expire

Added support for certificate lifetimes

update dependencies

Add AWS S3 and Google GCS virtual filesystems

Save oauth 'state' identifier in the client

This allows the signing key to be read directly from S3 using a path like
/s3/<bucket>/<path/to/signing.key> or /gcs/<bucket>/<path/to/signing.key>.