ghodss/yaml converts from YAML to JSON before attempting to unmarshal.
This allows us to:

* Get the correct behavor when decoding base64'd []byte slices.
* Use *json.RawMessage.
* Not have to support extravagant YAML features.
* Let our structs use `json:` tags

cmd/dex: add option for gRPC client auth CA.

*: don't error out if a username doesn't exist in the backing connector

api: add gRPC endpoints for creating, updating and deleting passwords

Instead of throwing a 500 error if a user enters an invalid name,
display the same text box as if the user had entered the wrong
password.

NOTE: An invalid username now returns much quicker than an invalid
password. Consider adding an arbitrary sleep in the future if we
care about masking which was invalid.

storage/sql: use isolation level "serializable" for transactions

Documentation: add document on the dex API

contrib/openldap: remove OpenLDAP container

Based on #640 we're going to osixia/openldap instead of rolling our
own container. Removing this work for now. If we want it back we can
revert easily enough.

storage: update godocs

connector/ldap: fix bug in switch statement

*: allow call connectors to share a single a single callback

storage/kubernetes: allow arbitrary client IDs

Use a hash algorithm to match client IDs to Kubernetes object names.
Because cryptographic hash algorithms produce sums larger than a
Kubernetes name can fit, a non-cryptographic hash is used instead.
Hash collisions are checked and result in errors.

storage/conformance: add tests for transactional guarantees

scripts: fix get-protoc script to work directly after a clean

Right now `make grpc` only works if a user hasn't run a `make clean`.
Fix this.

connector/ldap: expand LDAP connector to include searches

Documentation: adding documentation for running ldap tests locally

"state" means something specific to OAuth2 and SAML so we don't
want to confuse developers who are working on this.

Also don't use "session" which could easily be confused with HTTP
cookies.

Let the server handle the state token instead of the connector. As a
result it can throw out bad requests earlier. It can also use that
token to determine which connector was used to generate the request
allowing all connectors to share the same callback URL.

Callbacks now all look like:

    https://dex.example.com/callback

Instead of:

    https://dex.example.com/callback/(connector id)

Even when multiple connectors are being used.

server/handlers: fix Cache-Control header

fixes: #636

This commit addresses a problem where the `max-age` value is being set
in nanoseconds as opposed to seconds, as required by the specification.

Documentation: add a document on storage options

Merge pull request #626 from ericchiang/storage-kubernetes-guess-namespace-from-service-account-token

storage/kubernetes: guess namespace from the service account token