return refresh token only when scope contains 'offline_access'

Require 'openid' in scope for all requests.
Require 'offline_access' for returning refresh token.

cmd/dex-overlord: bind admin API on 127.0.0.1

Instead of 0.0.0.0; this is safer, since the admin API is very powerful.

fixes #97

Documentation: mv security_guide.md tls-setup.md

dex-worker: add TLS support.

Also add example tls-setup configs that can be used to generate
TLS CA, server certs, key files using 'cfssl'.

Add two new flags '--cert-file' and '--key-file'.
If scheme == 'https', then we will use the two new flags to get
the cert/key pair for TLS connection.

Also add '--ca-file' to the example app to allow TLS connection to the
dex-worker using a specified ca file.

examples/static: various changes to fix examples

OIDC Compliance Notes

server: make reset password pass tests

Handler wants a password value even when its blank

README.md/Documentation: Get Docs up-to-date. 

* key_secret -> key_secrets
* make sure overlord starts up before other operations since it creates
  the db
* remove race conditions by blocking on /health being up for worker and overlord

* Fix up README
* Create getting started guide.
* Start dev guide
* Start deploy guide

Base64 Encode secrets, and allow >1 of them

Two things here:

    * key secrets are now base64 encoded strings, so we get the full key
      space

    * we can pass >1 of them in so we can rotate them

mmmkay?

Allows setting of []byte's with base64 encoded strings and [][]bytes
with comma-separated base64 encoded strings.

The first secret is used to encrypt, the rest are for decryption; if the
first doesn't work, the rest are tried in order.

The makes it possible to rotate keys.

static: update all static templates to be generic & prettier

Move gorp to its new location.

README: explain the name dex

People are going to ask, might as well get it out there.

bug: remote whitespace so eval works

Update Quay link, remove semaphore link