authenticate: make service http only

- Rename SessionState to State to avoid stutter.
- Simplified option validation to use a wrapper function for base64 secrets.
- Removed authenticates grpc code.
- Abstracted logic to load and validate a user's authenticate session.
- Removed instances of url.Parse in favor of urlutil's version.
- proxy: replaces grpc refresh logic with forced deadline advancement.
- internal/sessions: remove rest store; parse authorize header as part of session store.
- proxy: refactor request signer
- sessions: remove extend deadline (fixes #294)
- remove AuthenticateInternalAddr
- remove AuthenticateInternalAddrString
- omit type tag.Key from declaration of vars TagKey* it will be inferred
  from the right-hand side
- remove compatibility package xerrors
- use cloned http.DefaultTransport as base transport

internal/config/options.go

@@ -97,13 +97,6 @@ type Options struct {
 	// (sudo) access including the ability to impersonate other users' access
 	Administrators []string `mapstructure:"administrators"`
 
-	// AuthenticateInternalAddr is used override the routable destination of
-	// authenticate service's GRPC endpoint.
-	// NOTE: As many load balancers do not support externally routed gRPC so
-	// this may be an internal location.
-	AuthenticateInternalAddrString string `mapstructure:"authenticate_internal_url"`
-	AuthenticateInternalAddr       *url.URL
-
 	// AuthorizeURL is the routable destination of the authorize service's
 	// gRPC endpoint. NOTE: As many load balancers do not support
 	// externally routed gRPC so this may be an internal location.
@@ -246,13 +239,6 @@ func (o *Options) Validate() error {
 		o.AuthorizeURL = u
 	}
 
-	if o.AuthenticateInternalAddrString != "" {
-		u, err := urlutil.ParseAndValidateURL(o.AuthenticateInternalAddrString)
-		if err != nil {
-			return fmt.Errorf("bad authenticate-internal-addr %s : %v", o.AuthenticateInternalAddrString, err)
-		}
-		o.AuthenticateInternalAddr = u
-	}
 	if o.PolicyFile != "" {
 		return errors.New("policy file setting is deprecated")
 	}