cmd/dex: only expand from env for storages and connectors

server: use seconds instead of nano seconds for expires_in and expiry

Documentation: add doc describing v2 changes

cmd/example-app: add a --debug flag

Bcrypt'd hashes have "$" characters in them. This means that #667
(accepting actually bcrypted values) combined with #627 (expanding
config with environment variables) broke the example config.

For now, allow storages and connectors to expand their configs from
the environment, but don't do this anywhere else.

cmd/dex: expose IDTokensValidFor and RotateKeysAfter server options in config

connector: accept base64 encoded CA and add convience open method

*: switch to github.com/ghodss/yaml for more consistent YAML parsing

ghodss/yaml converts from YAML to JSON before attempting to unmarshal.
This allows us to:

* Get the correct behavor when decoding base64'd []byte slices.
* Use *json.RawMessage.
* Not have to support extravagant YAML features.
* Let our structs use `json:` tags

*: travis tests and build scripts should use Go 1.7.3.

cmd/dex: add option for gRPC client auth CA.

*: don't error out if a username doesn't exist in the backing connector

api: add gRPC endpoints for creating, updating and deleting passwords

Instead of throwing a 500 error if a user enters an invalid name,
display the same text box as if the user had entered the wrong
password.

NOTE: An invalid username now returns much quicker than an invalid
password. Consider adding an arbitrary sleep in the future if we
care about masking which was invalid.

storage/sql: use isolation level "serializable" for transactions

Documentation: add document on the dex API

contrib/openldap: remove OpenLDAP container

Based on #640 we're going to osixia/openldap instead of rolling our
own container. Removing this work for now. If we want it back we can
revert easily enough.

storage: update godocs

connector/ldap: fix bug in switch statement

*: allow call connectors to share a single a single callback

storage/kubernetes: allow arbitrary client IDs