authenticate: handle XHR redirect flow (#387)

- authenticate: add cors preflight check support for sign_in endpoint
- internal/httputil: indicate responses that originate from pomerium vs the app
- proxy: detect XHR requests and do not redirect on failure.
- authenticate: removed default session duration; should be maintained out of band with rpc.

internal/httputil/handlers.go

@@ -17,3 +17,10 @@ func HealthCheck(w http.ResponseWriter, r *http.Request) {
 		w.Write([]byte(http.StatusText(http.StatusOK)))
 	}
 }
+
+// Redirect wraps the std libs's redirect method indicating that pomerium is
+// the origin of the response.
+func Redirect(w http.ResponseWriter, r *http.Request, url string, code int) {
+	w.Header().Set(HeaderPomeriumResponse, "true")
+	http.Redirect(w, r, url, code)
+}