verify avatar pattern from requests

allow to (re)define dev oauth port (go-pkgz#77)

* allow to (re)define dev oauth port

* add disable mono svc on :8084

* correct docs

* another typo in docs

missing SameSite passing

update mongo driver deps

move requests struct to TelegramHandler

RBAC with multiple roles and chains-friendly (go-pkgz#66)

* convert rbac middleware to traditional form

* fix test for rbac, not expecting token refresh anymore

* support multiple roles in RBAC middleware

* add rbac test with no role in

Simple Role Based access control

* auth.RBAC method for handlers
* developers can set optional roles in claims updater claims.User.SetRole

Microsoft (azure) oauth2 provider (go-pkgz#56)

* add MS azure oauth2 provider

* add support of MS avatars

* simplify loaded avatar flow

* lint: increase allowed complexity

* get rid of single-shot hack server, allow custom http client in avatar loader

* add ms to providers test

* add MS to demo title

according to doc string /private_data returns json with user info

Merge pull request go-pkgz#44 from paskal/bump_bbolt

Multiple fixes