Avoid unmarshalling into an intermediate struct.
Better tests.

The 'datastore' string option is deprecated and will be removed in a
future version. The new 'database' map option is preferred.

Vault is supported for the following:
As a well-known filesystem for TLS cert, TLS key and SSH signing key.
For configuration secrets for cookie_secret, csrf_secret, oauth_client_id and oauth_client_secret options.

Also tweak travis config

The server will always overwrite this field with the username obtained from
the auth provider. Allowing the client to set it is a waste of time.

First attempt at dropping privileges

Add contributing section