From b8c89a5e0f8ae73991d3d0dfe506cbb0112f3a31 Mon Sep 17 00:00:00 2001
From: Knut Ahlers <knut@ahlers.me>
Date: Tue, 23 Apr 2019 00:41:08 +0200
Subject: [PATCH] Vendor new dependencies for OIDC

Signed-off-by: Knut Ahlers <knut@ahlers.me>
---
 Gopkg.lock                                    |   35 +
 vendor/github.com/coreos/go-oidc/.gitignore   |    2 +
 vendor/github.com/coreos/go-oidc/.travis.yml  |   16 +
 .../github.com/coreos/go-oidc/CONTRIBUTING.md |   71 +
 vendor/github.com/coreos/go-oidc/DCO          |   36 +
 vendor/github.com/coreos/go-oidc/LICENSE      |  202 +++
 vendor/github.com/coreos/go-oidc/MAINTAINERS  |    2 +
 vendor/github.com/coreos/go-oidc/NOTICE       |    5 +
 vendor/github.com/coreos/go-oidc/README.md    |   72 +
 .../coreos/go-oidc/code-of-conduct.md         |   61 +
 .../coreos/go-oidc/example/README.md          |   21 +
 .../coreos/go-oidc/example/idtoken/app.go     |   92 +
 .../coreos/go-oidc/example/nonce/app.go       |  100 ++
 .../coreos/go-oidc/example/userinfo/app.go    |   76 +
 vendor/github.com/coreos/go-oidc/jose.go      |   20 +
 vendor/github.com/coreos/go-oidc/jwks.go      |  228 +++
 vendor/github.com/coreos/go-oidc/jwks_test.go |  250 +++
 vendor/github.com/coreos/go-oidc/oidc.go      |  374 +++++
 vendor/github.com/coreos/go-oidc/oidc_test.go |   95 ++
 vendor/github.com/coreos/go-oidc/test         |   16 +
 vendor/github.com/coreos/go-oidc/verify.go    |  243 +++
 .../github.com/coreos/go-oidc/verify_test.go  |  272 +++
 .../pquerna/cachecontrol/.travis.yml          |   10 +
 .../github.com/pquerna/cachecontrol/LICENSE   |  202 +++
 .../github.com/pquerna/cachecontrol/README.md |  107 ++
 vendor/github.com/pquerna/cachecontrol/api.go |   48 +
 .../pquerna/cachecontrol/api_test.go          |  111 ++
 .../cachecontrol/cacheobject/directive.go     |  546 ++++++
 .../cacheobject/directive_test.go             |  454 +++++
 .../pquerna/cachecontrol/cacheobject/lex.go   |   93 ++
 .../cachecontrol/cacheobject/object.go        |  387 +++++
 .../cacheobject/object_http_test.go           |   91 +
 .../cachecontrol/cacheobject/object_test.go   |  394 +++++
 .../cachecontrol/cacheobject/reasons.go       |   95 ++
 .../cachecontrol/cacheobject/warning.go       |  107 ++
 vendor/github.com/pquerna/cachecontrol/doc.go |   25 +
 .../cachecontrol/examples/example-com.go      |   21 +
 .../examples/lowlevel/ll-example-com.go       |   48 +
 .../square/go-jose.v2/.gitcookies.sh.enc      |    1 +
 vendor/gopkg.in/square/go-jose.v2/.gitignore  |    7 +
 vendor/gopkg.in/square/go-jose.v2/.travis.yml |   46 +
 .../gopkg.in/square/go-jose.v2/BUG-BOUNTY.md  |   10 +
 .../square/go-jose.v2/CONTRIBUTING.md         |   14 +
 vendor/gopkg.in/square/go-jose.v2/LICENSE     |  202 +++
 vendor/gopkg.in/square/go-jose.v2/README.md   |  118 ++
 .../gopkg.in/square/go-jose.v2/asymmetric.go  |  592 +++++++
 .../square/go-jose.v2/asymmetric_test.go      |  388 +++++
 .../square/go-jose.v2/cipher/cbc_hmac.go      |  196 +++
 .../square/go-jose.v2/cipher/cbc_hmac_test.go |  498 ++++++
 .../square/go-jose.v2/cipher/concat_kdf.go    |   75 +
 .../go-jose.v2/cipher/concat_kdf_test.go      |  150 ++
 .../square/go-jose.v2/cipher/ecdh_es.go       |   62 +
 .../square/go-jose.v2/cipher/ecdh_es_test.go  |  115 ++
 .../square/go-jose.v2/cipher/key_wrap.go      |  109 ++
 .../square/go-jose.v2/cipher/key_wrap_test.go |  133 ++
 vendor/gopkg.in/square/go-jose.v2/crypter.go  |  535 ++++++
 .../square/go-jose.v2/crypter_test.go         | 1070 ++++++++++++
 .../go-jose.v2/cryptosigner/cryptosigner.go   |  138 ++
 .../cryptosigner/cryptosigner_test.go         |  137 ++
 vendor/gopkg.in/square/go-jose.v2/doc.go      |   27 +
 vendor/gopkg.in/square/go-jose.v2/doc_test.go |  201 +++
 vendor/gopkg.in/square/go-jose.v2/encoding.go |  179 ++
 .../square/go-jose.v2/encoding_test.go        |  122 ++
 .../square/go-jose.v2/jose-util/README.md     |   59 +
 .../square/go-jose.v2/jose-util/ec.key        |    6 +
 .../square/go-jose.v2/jose-util/ec.pub        |    5 +
 .../square/go-jose.v2/jose-util/jose-util.t   |   94 ++
 .../square/go-jose.v2/jose-util/main.go       |  189 +++
 .../go-jose.v2/jose-util/test-keys/ecdh.key   |    6 +
 .../go-jose.v2/jose-util/test-keys/ecdh.pub   |    5 +
 .../go-jose.v2/jose-util/test-keys/rsa.key    |   27 +
 .../go-jose.v2/jose-util/test-keys/rsa.pub    |    9 +
 .../square/go-jose.v2/jose-util/utils.go      |  101 ++
 .../gopkg.in/square/go-jose.v2/json/LICENSE   |   27 +
 .../gopkg.in/square/go-jose.v2/json/README.md |   13 +
 .../square/go-jose.v2/json/bench_test.go      |  223 +++
 .../gopkg.in/square/go-jose.v2/json/decode.go | 1183 +++++++++++++
 .../square/go-jose.v2/json/decode_test.go     | 1474 +++++++++++++++++
 .../gopkg.in/square/go-jose.v2/json/encode.go | 1197 +++++++++++++
 .../square/go-jose.v2/json/encode_test.go     |  538 ++++++
 .../gopkg.in/square/go-jose.v2/json/indent.go |  141 ++
 .../square/go-jose.v2/json/number_test.go     |  133 ++
 .../square/go-jose.v2/json/scanner.go         |  623 +++++++
 .../square/go-jose.v2/json/scanner_test.go    |  316 ++++
 .../gopkg.in/square/go-jose.v2/json/stream.go |  480 ++++++
 .../square/go-jose.v2/json/stream_test.go     |  354 ++++
 .../square/go-jose.v2/json/tagkey_test.go     |  115 ++
 .../gopkg.in/square/go-jose.v2/json/tags.go   |   44 +
 .../square/go-jose.v2/json/tags_test.go       |   28 +
 .../go-jose.v2/json/testdata/code.json.gz     |  Bin 0 -> 120432 bytes
 vendor/gopkg.in/square/go-jose.v2/jwe.go      |  294 ++++
 vendor/gopkg.in/square/go-jose.v2/jwe_test.go |  619 +++++++
 .../square/go-jose.v2/jwk-keygen/README.md    |   35 +
 .../square/go-jose.v2/jwk-keygen/main.go      |  200 +++
 vendor/gopkg.in/square/go-jose.v2/jwk.go      |  608 +++++++
 vendor/gopkg.in/square/go-jose.v2/jwk_test.go |  884 ++++++++++
 vendor/gopkg.in/square/go-jose.v2/jws.go      |  321 ++++
 vendor/gopkg.in/square/go-jose.v2/jws_test.go |  616 +++++++
 .../gopkg.in/square/go-jose.v2/jwt/builder.go |  334 ++++
 .../square/go-jose.v2/jwt/builder_test.go     |  507 ++++++
 .../gopkg.in/square/go-jose.v2/jwt/claims.go  |  120 ++
 .../square/go-jose.v2/jwt/claims_test.go      |  115 ++
 vendor/gopkg.in/square/go-jose.v2/jwt/doc.go  |   22 +
 .../gopkg.in/square/go-jose.v2/jwt/errors.go  |   53 +
 .../square/go-jose.v2/jwt/example_test.go     |  340 ++++
 vendor/gopkg.in/square/go-jose.v2/jwt/jwt.go  |  163 ++
 .../square/go-jose.v2/jwt/jwt_test.go         |  217 +++
 .../square/go-jose.v2/jwt/validation.go       |  114 ++
 .../square/go-jose.v2/jwt/validation_test.go  |  167 ++
 vendor/gopkg.in/square/go-jose.v2/opaque.go   |   83 +
 .../gopkg.in/square/go-jose.v2/opaque_test.go |  192 +++
 vendor/gopkg.in/square/go-jose.v2/shared.go   |  499 ++++++
 vendor/gopkg.in/square/go-jose.v2/signing.go  |  389 +++++
 .../square/go-jose.v2/signing_test.go         |  523 ++++++
 .../gopkg.in/square/go-jose.v2/symmetric.go   |  482 ++++++
 .../square/go-jose.v2/symmetric_test.go       |  196 +++
 .../gopkg.in/square/go-jose.v2/utils_test.go  |   80 +
 117 files changed, 25716 insertions(+)
 create mode 100644 vendor/github.com/coreos/go-oidc/.gitignore
 create mode 100644 vendor/github.com/coreos/go-oidc/.travis.yml
 create mode 100644 vendor/github.com/coreos/go-oidc/CONTRIBUTING.md
 create mode 100644 vendor/github.com/coreos/go-oidc/DCO
 create mode 100644 vendor/github.com/coreos/go-oidc/LICENSE
 create mode 100644 vendor/github.com/coreos/go-oidc/MAINTAINERS
 create mode 100644 vendor/github.com/coreos/go-oidc/NOTICE
 create mode 100644 vendor/github.com/coreos/go-oidc/README.md
 create mode 100644 vendor/github.com/coreos/go-oidc/code-of-conduct.md
 create mode 100644 vendor/github.com/coreos/go-oidc/example/README.md
 create mode 100644 vendor/github.com/coreos/go-oidc/example/idtoken/app.go
 create mode 100644 vendor/github.com/coreos/go-oidc/example/nonce/app.go
 create mode 100644 vendor/github.com/coreos/go-oidc/example/userinfo/app.go
 create mode 100644 vendor/github.com/coreos/go-oidc/jose.go
 create mode 100644 vendor/github.com/coreos/go-oidc/jwks.go
 create mode 100644 vendor/github.com/coreos/go-oidc/jwks_test.go
 create mode 100644 vendor/github.com/coreos/go-oidc/oidc.go
 create mode 100644 vendor/github.com/coreos/go-oidc/oidc_test.go
 create mode 100755 vendor/github.com/coreos/go-oidc/test
 create mode 100644 vendor/github.com/coreos/go-oidc/verify.go
 create mode 100644 vendor/github.com/coreos/go-oidc/verify_test.go
 create mode 100644 vendor/github.com/pquerna/cachecontrol/.travis.yml
 create mode 100644 vendor/github.com/pquerna/cachecontrol/LICENSE
 create mode 100644 vendor/github.com/pquerna/cachecontrol/README.md
 create mode 100644 vendor/github.com/pquerna/cachecontrol/api.go
 create mode 100644 vendor/github.com/pquerna/cachecontrol/api_test.go
 create mode 100644 vendor/github.com/pquerna/cachecontrol/cacheobject/directive.go
 create mode 100644 vendor/github.com/pquerna/cachecontrol/cacheobject/directive_test.go
 create mode 100644 vendor/github.com/pquerna/cachecontrol/cacheobject/lex.go
 create mode 100644 vendor/github.com/pquerna/cachecontrol/cacheobject/object.go
 create mode 100644 vendor/github.com/pquerna/cachecontrol/cacheobject/object_http_test.go
 create mode 100644 vendor/github.com/pquerna/cachecontrol/cacheobject/object_test.go
 create mode 100644 vendor/github.com/pquerna/cachecontrol/cacheobject/reasons.go
 create mode 100644 vendor/github.com/pquerna/cachecontrol/cacheobject/warning.go
 create mode 100644 vendor/github.com/pquerna/cachecontrol/doc.go
 create mode 100644 vendor/github.com/pquerna/cachecontrol/examples/example-com.go
 create mode 100644 vendor/github.com/pquerna/cachecontrol/examples/lowlevel/ll-example-com.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/.gitcookies.sh.enc
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/.gitignore
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/.travis.yml
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/BUG-BOUNTY.md
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/CONTRIBUTING.md
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/LICENSE
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/README.md
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/asymmetric.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/asymmetric_test.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/cipher/cbc_hmac.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/cipher/cbc_hmac_test.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/cipher/concat_kdf.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/cipher/concat_kdf_test.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/cipher/ecdh_es.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/cipher/ecdh_es_test.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/cipher/key_wrap.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/cipher/key_wrap_test.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/crypter.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/crypter_test.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/cryptosigner/cryptosigner.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/cryptosigner/cryptosigner_test.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/doc.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/doc_test.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/encoding.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/encoding_test.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/jose-util/README.md
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/jose-util/ec.key
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/jose-util/ec.pub
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/jose-util/jose-util.t
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/jose-util/main.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/jose-util/test-keys/ecdh.key
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/jose-util/test-keys/ecdh.pub
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/jose-util/test-keys/rsa.key
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/jose-util/test-keys/rsa.pub
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/jose-util/utils.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/json/LICENSE
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/json/README.md
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/json/bench_test.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/json/decode.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/json/decode_test.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/json/encode.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/json/encode_test.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/json/indent.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/json/number_test.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/json/scanner.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/json/scanner_test.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/json/stream.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/json/stream_test.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/json/tagkey_test.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/json/tags.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/json/tags_test.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/json/testdata/code.json.gz
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/jwe.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/jwe_test.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/jwk-keygen/README.md
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/jwk-keygen/main.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/jwk.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/jwk_test.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/jws.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/jws_test.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/jwt/builder.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/jwt/builder_test.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/jwt/claims.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/jwt/claims_test.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/jwt/doc.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/jwt/errors.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/jwt/example_test.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/jwt/jwt.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/jwt/jwt_test.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/jwt/validation.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/jwt/validation_test.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/opaque.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/opaque_test.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/shared.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/signing.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/signing_test.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/symmetric.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/symmetric_test.go
 create mode 100644 vendor/gopkg.in/square/go-jose.v2/utils_test.go

diff --git a/Gopkg.lock b/Gopkg.lock
index 62540b4..4d90cb8 100644
--- a/Gopkg.lock
+++ b/Gopkg.lock
@@ -45,6 +45,14 @@
   revision = "3cfea5ab600ae37946be2b763b8ec2c1cf2d272d"
   version = "v1.0.0"
 
+[[projects]]
+  digest = "1:d8ee1b165eb7f4fd9ada718e1e7eeb0bc1fd462592d0bd823df694443f448681"
+  name = "github.com/coreos/go-oidc"
+  packages = ["."]
+  pruneopts = ""
+  revision = "1180514eaf4d9f38d0d19eef639a1d695e066e72"
+  version = "v2.0.0"
+
 [[projects]]
   branch = "master"
   digest = "1:f65bcfc1efab621eaf5df43869dd1aee399a298c299423c08b96a3b037437c48"
@@ -142,6 +150,17 @@
   revision = "ba968bfe8b2f7e042a574c888954fccecfa385b4"
   version = "v0.8.1"
 
+[[projects]]
+  branch = "master"
+  digest = "1:de5481dda0c081b66450e391bbb1a5c4435b13e3c0bbf0133ba1a5baeda7b7af"
+  name = "github.com/pquerna/cachecontrol"
+  packages = [
+    ".",
+    "cacheobject",
+  ]
+  pruneopts = ""
+  revision = "1555304b9b35fdd2b425bccf1a5613677705e7d0"
+
 [[projects]]
   digest = "1:d8c398c75a666d415196ba289402c3f52b595d8cede451a9e57278354e327a93"
   name = "github.com/pquerna/otp"
@@ -202,6 +221,9 @@
   packages = [
     "bcrypt",
     "blowfish",
+    "ed25519",
+    "ed25519/internal/edwards25519",
+    "pbkdf2",
   ]
   pruneopts = ""
   revision = "df01cb2cc480549d72034218dd98bf97671450ac"
@@ -370,6 +392,18 @@
   revision = "bb7a9ca6e4fbc2129e3db588a34bc970ffe811a9"
   version = "v2.5.1"
 
+[[projects]]
+  digest = "1:40cf02345bfa29fb217cfe0767a9416d99569d4ff21dbb1fd3378ef10682549c"
+  name = "gopkg.in/square/go-jose.v2"
+  packages = [
+    ".",
+    "cipher",
+    "json",
+  ]
+  pruneopts = ""
+  revision = "730df5f748271903322feb182be83b43ebbbe27d"
+  version = "v2.3.1"
+
 [[projects]]
   branch = "v2"
   digest = "1:bf922c860f64bb6372daa82bb9c1e8ed144e97ac7587efa80d08b4e98737e9ea"
@@ -393,6 +427,7 @@
     "github.com/GeertJohan/yubigo",
     "github.com/Luzifer/go_helpers/str",
     "github.com/Luzifer/rconfig",
+    "github.com/coreos/go-oidc",
     "github.com/duosecurity/duo_api_golang",
     "github.com/duosecurity/duo_api_golang/authapi",
     "github.com/flosch/pongo2",
diff --git a/vendor/github.com/coreos/go-oidc/.gitignore b/vendor/github.com/coreos/go-oidc/.gitignore
new file mode 100644
index 0000000..c96f2f4
--- /dev/null
+++ b/vendor/github.com/coreos/go-oidc/.gitignore
@@ -0,0 +1,2 @@
+/bin
+/gopath
diff --git a/vendor/github.com/coreos/go-oidc/.travis.yml b/vendor/github.com/coreos/go-oidc/.travis.yml
new file mode 100644
index 0000000..f2f3c9c
--- /dev/null
+++ b/vendor/github.com/coreos/go-oidc/.travis.yml
@@ -0,0 +1,16 @@
+language: go
+
+go:
+  - 1.7.5
+  - 1.8
+
+install:
+ - go get -v -t github.com/coreos/go-oidc/...
+ - go get golang.org/x/tools/cmd/cover
+ - go get github.com/golang/lint/golint
+
+script:
+ - ./test
+
+notifications:
+  email: false
diff --git a/vendor/github.com/coreos/go-oidc/CONTRIBUTING.md b/vendor/github.com/coreos/go-oidc/CONTRIBUTING.md
new file mode 100644
index 0000000..6662073
--- /dev/null
+++ b/vendor/github.com/coreos/go-oidc/CONTRIBUTING.md
@@ -0,0 +1,71 @@
+# How to Contribute
+
+CoreOS projects are [Apache 2.0 licensed](LICENSE) and accept contributions via
+GitHub pull requests.  This document outlines some of the conventions on
+development workflow, commit message formatting, contact points and other
+resources to make it easier to get your contribution accepted.
+
+# Certificate of Origin
+
+By contributing to this project you agree to the Developer Certificate of
+Origin (DCO). This document was created by the Linux Kernel community and is a
+simple statement that you, as a contributor, have the legal right to make the
+contribution. See the [DCO](DCO) file for details.
+
+# Email and Chat
+
+The project currently uses the general CoreOS email list and IRC channel:
+- Email: [coreos-dev](https://groups.google.com/forum/#!forum/coreos-dev)
+- IRC: #[coreos](irc://irc.freenode.org:6667/#coreos) IRC channel on freenode.org
+
+Please avoid emailing maintainers found in the MAINTAINERS file directly. They
+are very busy and read the mailing lists.
+
+## Getting Started
+
+- Fork the repository on GitHub
+- Read the [README](README.md) for build and test instructions
+- Play with the project, submit bugs, submit patches!
+
+## Contribution Flow
+
+This is a rough outline of what a contributor's workflow looks like:
+
+- Create a topic branch from where you want to base your work (usually master).
+- Make commits of logical units.
+- Make sure your commit messages are in the proper format (see below).
+- Push your changes to a topic branch in your fork of the repository.
+- Make sure the tests pass, and add any new tests as appropriate.
+- Submit a pull request to the original repository.
+
+Thanks for your contributions!
+
+### Format of the Commit Message
+
+We follow a rough convention for commit messages that is designed to answer two
+questions: what changed and why. The subject line should feature the what and
+the body of the commit should describe the why.
+
+```
+scripts: add the test-cluster command
+
+this uses tmux to setup a test cluster that you can easily kill and
+start for debugging.
+
+Fixes #38
+```
+
+The format can be described more formally as follows:
+
+```
+<subsystem>: <what changed>
+<BLANK LINE>
+<why this change was made>
+<BLANK LINE>
+<footer>
+```
+
+The first line is the subject and should be no longer than 70 characters, the
+second line is always blank, and other lines should be wrapped at 80 characters.
+This allows the message to be easier to read on GitHub as well as in various
+git tools.
diff --git a/vendor/github.com/coreos/go-oidc/DCO b/vendor/github.com/coreos/go-oidc/DCO
new file mode 100644
index 0000000..716561d
--- /dev/null
+++ b/vendor/github.com/coreos/go-oidc/DCO
@@ -0,0 +1,36 @@
+Developer Certificate of Origin
+Version 1.1
+
+Copyright (C) 2004, 2006 The Linux Foundation and its contributors.
+660 York Street, Suite 102,
+San Francisco, CA 94110 USA
+
+Everyone is permitted to copy and distribute verbatim copies of this
+license document, but changing it is not allowed.
+
+
+Developer's Certificate of Origin 1.1
+
+By making a contribution to this project, I certify that:
+
+(a) The contribution was created in whole or in part by me and I
+    have the right to submit it under the open source license
+    indicated in the file; or
+
+(b) The contribution is based upon previous work that, to the best
+    of my knowledge, is covered under an appropriate open source
+    license and I have the right under that license to submit that
+    work with modifications, whether created in whole or in part
+    by me, under the same open source license (unless I am
+    permitted to submit under a different license), as indicated
+    in the file; or
+
+(c) The contribution was provided directly to me by some other
+    person who certified (a), (b) or (c) and I have not modified
+    it.
+
+(d) I understand and agree that this project and the contribution
+    are public and that a record of the contribution (including all
+    personal information I submit with it, including my sign-off) is
+    maintained indefinitely and may be redistributed consistent with
+    this project or the open source license(s) involved.
diff --git a/vendor/github.com/coreos/go-oidc/LICENSE b/vendor/github.com/coreos/go-oidc/LICENSE
new file mode 100644
index 0000000..e06d208
--- /dev/null
+++ b/vendor/github.com/coreos/go-oidc/LICENSE
@@ -0,0 +1,202 @@
+Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "{}"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright {yyyy} {name of copyright owner}
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
diff --git a/vendor/github.com/coreos/go-oidc/MAINTAINERS b/vendor/github.com/coreos/go-oidc/MAINTAINERS
new file mode 100644
index 0000000..0a1f293
--- /dev/null
+++ b/vendor/github.com/coreos/go-oidc/MAINTAINERS
@@ -0,0 +1,2 @@
+Eric Chiang <echiang@redhat.com> (@ericchiang)
+Rithu Leena John <rjohn@redhat.com> (@rithujohn191)
diff --git a/vendor/github.com/coreos/go-oidc/NOTICE b/vendor/github.com/coreos/go-oidc/NOTICE
new file mode 100644
index 0000000..b39ddfa
--- /dev/null
+++ b/vendor/github.com/coreos/go-oidc/NOTICE
@@ -0,0 +1,5 @@
+CoreOS Project
+Copyright 2014 CoreOS, Inc
+
+This product includes software developed at CoreOS, Inc.
+(http://www.coreos.com/).
diff --git a/vendor/github.com/coreos/go-oidc/README.md b/vendor/github.com/coreos/go-oidc/README.md
new file mode 100644
index 0000000..520d7c8
--- /dev/null
+++ b/vendor/github.com/coreos/go-oidc/README.md
@@ -0,0 +1,72 @@
+# go-oidc
+
+[![GoDoc](https://godoc.org/github.com/coreos/go-oidc?status.svg)](https://godoc.org/github.com/coreos/go-oidc)
+[![Build Status](https://travis-ci.org/coreos/go-oidc.png?branch=master)](https://travis-ci.org/coreos/go-oidc)
+
+## OpenID Connect support for Go
+
+This package enables OpenID Connect support for the [golang.org/x/oauth2](https://godoc.org/golang.org/x/oauth2) package.
+
+```go
+provider, err := oidc.NewProvider(ctx, "https://accounts.google.com")
+if err != nil {
+    // handle error
+}
+
+// Configure an OpenID Connect aware OAuth2 client.
+oauth2Config := oauth2.Config{
+    ClientID:     clientID,
+    ClientSecret: clientSecret,
+    RedirectURL:  redirectURL,
+
+    // Discovery returns the OAuth2 endpoints.
+    Endpoint: provider.Endpoint(),
+
+    // "openid" is a required scope for OpenID Connect flows.
+    Scopes: []string{oidc.ScopeOpenID, "profile", "email"},
+}
+```
+
+OAuth2 redirects are unchanged.
+
+```go
+func handleRedirect(w http.ResponseWriter, r *http.Request) {
+    http.Redirect(w, r, oauth2Config.AuthCodeURL(state), http.StatusFound)
+}
+```
+
+The on responses, the provider can be used to verify ID Tokens.
+
+```go
+var verifier = provider.Verifier(&oidc.Config{ClientID: clientID})
+
+func handleOAuth2Callback(w http.ResponseWriter, r *http.Request) {
+    // Verify state and errors.
+
+    oauth2Token, err := oauth2Config.Exchange(ctx, r.URL.Query().Get("code"))
+    if err != nil {
+        // handle error
+    }
+
+    // Extract the ID Token from OAuth2 token.
+    rawIDToken, ok := oauth2Token.Extra("id_token").(string)
+    if !ok {
+        // handle missing token
+    }
+
+    // Parse and verify ID Token payload.
+    idToken, err := verifier.Verify(ctx, rawIDToken)
+    if err != nil {
+        // handle error
+    }
+
+    // Extract custom claims
+    var claims struct {
+        Email    string `json:"email"`
+        Verified bool   `json:"email_verified"`
+    }
+    if err := idToken.Claims(&claims); err != nil {
+        // handle error
+    }
+}
+```
diff --git a/vendor/github.com/coreos/go-oidc/code-of-conduct.md b/vendor/github.com/coreos/go-oidc/code-of-conduct.md
new file mode 100644
index 0000000..a234f36
--- /dev/null
+++ b/vendor/github.com/coreos/go-oidc/code-of-conduct.md
@@ -0,0 +1,61 @@
+## CoreOS Community Code of Conduct
+
+### Contributor Code of Conduct
+
+As contributors and maintainers of this project, and in the interest of
+fostering an open and welcoming community, we pledge to respect all people who
+contribute through reporting issues, posting feature requests, updating
+documentation, submitting pull requests or patches, and other activities.
+
+We are committed to making participation in this project a harassment-free
+experience for everyone, regardless of level of experience, gender, gender
+identity and expression, sexual orientation, disability, personal appearance,
+body size, race, ethnicity, age, religion, or nationality.
+
+Examples of unacceptable behavior by participants include:
+
+* The use of sexualized language or imagery
+* Personal attacks
+* Trolling or insulting/derogatory comments
+* Public or private harassment
+* Publishing others' private information, such as physical or electronic addresses, without explicit permission
+* Other unethical or unprofessional conduct.
+
+Project maintainers have the right and responsibility to remove, edit, or
+reject comments, commits, code, wiki edits, issues, and other contributions
+that are not aligned to this Code of Conduct. By adopting this Code of Conduct,
+project maintainers commit themselves to fairly and consistently applying these
+principles to every aspect of managing this project. Project maintainers who do
+not follow or enforce the Code of Conduct may be permanently removed from the
+project team.
+
+This code of conduct applies both within project spaces and in public spaces
+when an individual is representing the project or its community.
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported by contacting a project maintainer, Brandon Philips
+<brandon.philips@coreos.com>, and/or Rithu John <rithu.john@coreos.com>.
+
+This Code of Conduct is adapted from the Contributor Covenant
+(http://contributor-covenant.org), version 1.2.0, available at
+http://contributor-covenant.org/version/1/2/0/
+
+### CoreOS Events Code of Conduct
+
+CoreOS events are working conferences intended for professional networking and
+collaboration in the CoreOS community. Attendees are expected to behave
+according to professional standards and in accordance with their employer’s
+policies on appropriate workplace behavior.
+
+While at CoreOS events or related social networking opportunities, attendees
+should not engage in discriminatory or offensive speech or actions including
+but not limited to gender, sexuality, race, age, disability, or religion.
+Speakers should be especially aware of these concerns.
+
+CoreOS does not condone any statements by speakers contrary to these standards.
+CoreOS reserves the right to deny entrance and/or eject from an event (without
+refund) any individual found to be engaging in discriminatory or offensive
+speech or actions.
+
+Please bring any concerns to the immediate attention of designated on-site
+staff, Brandon Philips <brandon.philips@coreos.com>, and/or Rithu John <rithu.john@coreos.com>.
diff --git a/vendor/github.com/coreos/go-oidc/example/README.md b/vendor/github.com/coreos/go-oidc/example/README.md
new file mode 100644
index 0000000..93f84c8
--- /dev/null
+++ b/vendor/github.com/coreos/go-oidc/example/README.md
@@ -0,0 +1,21 @@
+# Examples
+
+These are example uses of the oidc package. Each requires a Google account and the client ID and secret of a registered OAuth2 application. To create one:
+
+1. Visit your [Google Developer Console][google-developer-console].
+2. Click "Credentials" on the left column.
+3. Click the "Create credentials" button followed by "OAuth client ID".
+4. Select "Web application" and add "http://127.0.0.1:5556/auth/google/callback" as an authorized redirect URI.
+5. Click create and add the printed client ID and secret to your environment using the following variables:
+
+```
+GOOGLE_OAUTH2_CLIENT_ID
+GOOGLE_OAUTH2_CLIENT_SECRET
+```
+
+Finally run the examples using the Go tool and navigate to http://127.0.0.1:5556.
+
+```
+go run ./example/idtoken/app.go
+```
+[google-developer-console]: https://console.developers.google.com/apis/dashboard
diff --git a/vendor/github.com/coreos/go-oidc/example/idtoken/app.go b/vendor/github.com/coreos/go-oidc/example/idtoken/app.go
new file mode 100644
index 0000000..9e52ac2
--- /dev/null
+++ b/vendor/github.com/coreos/go-oidc/example/idtoken/app.go
@@ -0,0 +1,92 @@
+/*
+This is an example application to demonstrate parsing an ID Token.
+*/
+package main
+
+import (
+	"encoding/json"
+	"log"
+	"net/http"
+	"os"
+
+	oidc "github.com/coreos/go-oidc"
+
+	"golang.org/x/net/context"
+	"golang.org/x/oauth2"
+)
+
+var (
+	clientID     = os.Getenv("GOOGLE_OAUTH2_CLIENT_ID")
+	clientSecret = os.Getenv("GOOGLE_OAUTH2_CLIENT_SECRET")
+)
+
+func main() {
+	ctx := context.Background()
+
+	provider, err := oidc.NewProvider(ctx, "https://accounts.google.com")
+	if err != nil {
+		log.Fatal(err)
+	}
+	oidcConfig := &oidc.Config{
+		ClientID: clientID,
+	}
+	verifier := provider.Verifier(oidcConfig)
+
+	config := oauth2.Config{
+		ClientID:     clientID,
+		ClientSecret: clientSecret,
+		Endpoint:     provider.Endpoint(),
+		RedirectURL:  "http://127.0.0.1:5556/auth/google/callback",
+		Scopes:       []string{oidc.ScopeOpenID, "profile", "email"},
+	}
+
+	state := "foobar" // Don't do this in production.
+
+	http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
+		http.Redirect(w, r, config.AuthCodeURL(state), http.StatusFound)
+	})
+
+	http.HandleFunc("/auth/google/callback", func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Query().Get("state") != state {
+			http.Error(w, "state did not match", http.StatusBadRequest)
+			return
+		}
+
+		oauth2Token, err := config.Exchange(ctx, r.URL.Query().Get("code"))
+		if err != nil {
+			http.Error(w, "Failed to exchange token: "+err.Error(), http.StatusInternalServerError)
+			return
+		}
+		rawIDToken, ok := oauth2Token.Extra("id_token").(string)
+		if !ok {
+			http.Error(w, "No id_token field in oauth2 token.", http.StatusInternalServerError)
+			return
+		}
+		idToken, err := verifier.Verify(ctx, rawIDToken)
+		if err != nil {
+			http.Error(w, "Failed to verify ID Token: "+err.Error(), http.StatusInternalServerError)
+			return
+		}
+
+		oauth2Token.AccessToken = "*REDACTED*"
+
+		resp := struct {
+			OAuth2Token   *oauth2.Token
+			IDTokenClaims *json.RawMessage // ID Token payload is just JSON.
+		}{oauth2Token, new(json.RawMessage)}
+
+		if err := idToken.Claims(&resp.IDTokenClaims); err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+		data, err := json.MarshalIndent(resp, "", "    ")
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+		w.Write(data)
+	})
+
+	log.Printf("listening on http://%s/", "127.0.0.1:5556")
+	log.Fatal(http.ListenAndServe("127.0.0.1:5556", nil))
+}
diff --git a/vendor/github.com/coreos/go-oidc/example/nonce/app.go b/vendor/github.com/coreos/go-oidc/example/nonce/app.go
new file mode 100644
index 0000000..2dcbd7d
--- /dev/null
+++ b/vendor/github.com/coreos/go-oidc/example/nonce/app.go
@@ -0,0 +1,100 @@
+/*
+This is an example application to demonstrate verifying an ID Token with a nonce.
+*/
+package main
+
+import (
+	"encoding/json"
+	"log"
+	"net/http"
+	"os"
+
+	oidc "github.com/coreos/go-oidc"
+
+	"golang.org/x/net/context"
+	"golang.org/x/oauth2"
+)
+
+var (
+	clientID     = os.Getenv("GOOGLE_OAUTH2_CLIENT_ID")
+	clientSecret = os.Getenv("GOOGLE_OAUTH2_CLIENT_SECRET")
+)
+
+const appNonce = "a super secret nonce"
+
+func main() {
+	ctx := context.Background()
+
+	provider, err := oidc.NewProvider(ctx, "https://accounts.google.com")
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	oidcConfig := &oidc.Config{
+		ClientID: clientID,
+	}
+	// Use the nonce source to create a custom ID Token verifier.
+	nonceEnabledVerifier := provider.Verifier(oidcConfig)
+
+	config := oauth2.Config{
+		ClientID:     clientID,
+		ClientSecret: clientSecret,
+		Endpoint:     provider.Endpoint(),
+		RedirectURL:  "http://127.0.0.1:5556/auth/google/callback",
+		Scopes:       []string{oidc.ScopeOpenID, "profile", "email"},
+	}
+
+	state := "foobar" // Don't do this in production.
+
+	http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
+		http.Redirect(w, r, config.AuthCodeURL(state, oidc.Nonce(appNonce)), http.StatusFound)
+	})
+
+	http.HandleFunc("/auth/google/callback", func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Query().Get("state") != state {
+			http.Error(w, "state did not match", http.StatusBadRequest)
+			return
+		}
+
+		oauth2Token, err := config.Exchange(ctx, r.URL.Query().Get("code"))
+		if err != nil {
+			http.Error(w, "Failed to exchange token: "+err.Error(), http.StatusInternalServerError)
+			return
+		}
+
+		rawIDToken, ok := oauth2Token.Extra("id_token").(string)
+		if !ok {
+			http.Error(w, "No id_token field in oauth2 token.", http.StatusInternalServerError)
+			return
+		}
+		// Verify the ID Token signature and nonce.
+		idToken, err := nonceEnabledVerifier.Verify(ctx, rawIDToken)
+		if err != nil {
+			http.Error(w, "Failed to verify ID Token: "+err.Error(), http.StatusInternalServerError)
+			return
+		}
+		if idToken.Nonce != appNonce {
+			http.Error(w, "Invalid ID Token nonce", http.StatusInternalServerError)
+			return
+		}
+
+		resp := struct {
+			OAuth2Token   *oauth2.Token
+			IDTokenClaims *json.RawMessage // ID Token payload is just JSON.
+		}{oauth2Token, new(json.RawMessage)}
+
+		if err := idToken.Claims(&resp.IDTokenClaims); err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+		data, err := json.MarshalIndent(resp, "", "    ")
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+		w.Write(data)
+	})
+
+	log.Printf("listening on http://%s/", "127.0.0.1:5556")
+	log.Fatal(http.ListenAndServe("127.0.0.1:5556", nil))
+}
diff --git a/vendor/github.com/coreos/go-oidc/example/userinfo/app.go b/vendor/github.com/coreos/go-oidc/example/userinfo/app.go
new file mode 100644
index 0000000..0039088
--- /dev/null
+++ b/vendor/github.com/coreos/go-oidc/example/userinfo/app.go
@@ -0,0 +1,76 @@
+/*
+This is an example application to demonstrate querying the user info endpoint.
+*/
+package main
+
+import (
+	"encoding/json"
+	"log"
+	"net/http"
+	"os"
+
+	oidc "github.com/coreos/go-oidc"
+
+	"golang.org/x/net/context"
+	"golang.org/x/oauth2"
+)
+
+var (
+	clientID     = os.Getenv("GOOGLE_OAUTH2_CLIENT_ID")
+	clientSecret = os.Getenv("GOOGLE_OAUTH2_CLIENT_SECRET")
+)
+
+func main() {
+	ctx := context.Background()
+
+	provider, err := oidc.NewProvider(ctx, "https://accounts.google.com")
+	if err != nil {
+		log.Fatal(err)
+	}
+	config := oauth2.Config{
+		ClientID:     clientID,
+		ClientSecret: clientSecret,
+		Endpoint:     provider.Endpoint(),
+		RedirectURL:  "http://127.0.0.1:5556/auth/google/callback",
+		Scopes:       []string{oidc.ScopeOpenID, "profile", "email"},
+	}
+
+	state := "foobar" // Don't do this in production.
+
+	http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
+		http.Redirect(w, r, config.AuthCodeURL(state), http.StatusFound)
+	})
+
+	http.HandleFunc("/auth/google/callback", func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Query().Get("state") != state {
+			http.Error(w, "state did not match", http.StatusBadRequest)
+			return
+		}
+
+		oauth2Token, err := config.Exchange(ctx, r.URL.Query().Get("code"))
+		if err != nil {
+			http.Error(w, "Failed to exchange token: "+err.Error(), http.StatusInternalServerError)
+			return
+		}
+
+		userInfo, err := provider.UserInfo(ctx, oauth2.StaticTokenSource(oauth2Token))
+		if err != nil {
+			http.Error(w, "Failed to get userinfo: "+err.Error(), http.StatusInternalServerError)
+			return
+		}
+
+		resp := struct {
+			OAuth2Token *oauth2.Token
+			UserInfo    *oidc.UserInfo
+		}{oauth2Token, userInfo}
+		data, err := json.MarshalIndent(resp, "", "    ")
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+		w.Write(data)
+	})
+
+	log.Printf("listening on http://%s/", "127.0.0.1:5556")
+	log.Fatal(http.ListenAndServe("127.0.0.1:5556", nil))
+}
diff --git a/vendor/github.com/coreos/go-oidc/jose.go b/vendor/github.com/coreos/go-oidc/jose.go
new file mode 100644
index 0000000..f2e6bf4
--- /dev/null
+++ b/vendor/github.com/coreos/go-oidc/jose.go
@@ -0,0 +1,20 @@
+// +build !golint
+
+// Don't lint this file. We don't want to have to add a comment to each constant.
+
+package oidc
+
+const (
+	// JOSE asymmetric signing algorithm values as defined by RFC 7518
+	//
+	// see: https://tools.ietf.org/html/rfc7518#section-3.1
+	RS256 = "RS256" // RSASSA-PKCS-v1.5 using SHA-256
+	RS384 = "RS384" // RSASSA-PKCS-v1.5 using SHA-384
+	RS512 = "RS512" // RSASSA-PKCS-v1.5 using SHA-512
+	ES256 = "ES256" // ECDSA using P-256 and SHA-256
+	ES384 = "ES384" // ECDSA using P-384 and SHA-384
+	ES512 = "ES512" // ECDSA using P-521 and SHA-512
+	PS256 = "PS256" // RSASSA-PSS using SHA256 and MGF1-SHA256
+	PS384 = "PS384" // RSASSA-PSS using SHA384 and MGF1-SHA384
+	PS512 = "PS512" // RSASSA-PSS using SHA512 and MGF1-SHA512
+)
diff --git a/vendor/github.com/coreos/go-oidc/jwks.go b/vendor/github.com/coreos/go-oidc/jwks.go
new file mode 100644
index 0000000..e6a82c8
--- /dev/null
+++ b/vendor/github.com/coreos/go-oidc/jwks.go
@@ -0,0 +1,228 @@
+package oidc
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"sync"
+	"time"
+
+	"github.com/pquerna/cachecontrol"
+	jose "gopkg.in/square/go-jose.v2"
+)
+
+// keysExpiryDelta is the allowed clock skew between a client and the OpenID Connect
+// server.
+//
+// When keys expire, they are valid for this amount of time after.
+//
+// If the keys have not expired, and an ID Token claims it was signed by a key not in
+// the cache, if and only if the keys expire in this amount of time, the keys will be
+// updated.
+const keysExpiryDelta = 30 * time.Second
+
+// NewRemoteKeySet returns a KeySet that can validate JSON web tokens by using HTTP
+// GETs to fetch JSON web token sets hosted at a remote URL. This is automatically
+// used by NewProvider using the URLs returned by OpenID Connect discovery, but is
+// exposed for providers that don't support discovery or to prevent round trips to the
+// discovery URL.
+//
+// The returned KeySet is a long lived verifier that caches keys based on cache-control
+// headers. Reuse a common remote key set instead of creating new ones as needed.
+//
+// The behavior of the returned KeySet is undefined once the context is canceled.
+func NewRemoteKeySet(ctx context.Context, jwksURL string) KeySet {
+	return newRemoteKeySet(ctx, jwksURL, time.Now)
+}
+
+func newRemoteKeySet(ctx context.Context, jwksURL string, now func() time.Time) *remoteKeySet {
+	if now == nil {
+		now = time.Now
+	}
+	return &remoteKeySet{jwksURL: jwksURL, ctx: ctx, now: now}
+}
+
+type remoteKeySet struct {
+	jwksURL string
+	ctx     context.Context
+	now     func() time.Time
+
+	// guard all other fields
+	mu sync.Mutex
+
+	// inflight suppresses parallel execution of updateKeys and allows
+	// multiple goroutines to wait for its result.
+	inflight *inflight
+
+	// A set of cached keys and their expiry.
+	cachedKeys []jose.JSONWebKey
+	expiry     time.Time
+}
+
+// inflight is used to wait on some in-flight request from multiple goroutines.
+type inflight struct {
+	doneCh chan struct{}
+
+	keys []jose.JSONWebKey
+	err  error
+}
+
+func newInflight() *inflight {
+	return &inflight{doneCh: make(chan struct{})}
+}
+
+// wait returns a channel that multiple goroutines can receive on. Once it returns
+// a value, the inflight request is done and result() can be inspected.
+func (i *inflight) wait() <-chan struct{} {
+	return i.doneCh
+}
+
+// done can only be called by a single goroutine. It records the result of the
+// inflight request and signals other goroutines that the result is safe to
+// inspect.
+func (i *inflight) done(keys []jose.JSONWebKey, err error) {
+	i.keys = keys
+	i.err = err
+	close(i.doneCh)
+}
+
+// result cannot be called until the wait() channel has returned a value.
+func (i *inflight) result() ([]jose.JSONWebKey, error) {
+	return i.keys, i.err
+}
+
+func (r *remoteKeySet) VerifySignature(ctx context.Context, jwt string) ([]byte, error) {
+	jws, err := jose.ParseSigned(jwt)
+	if err != nil {
+		return nil, fmt.Errorf("oidc: malformed jwt: %v", err)
+	}
+	return r.verify(ctx, jws)
+}
+
+func (r *remoteKeySet) verify(ctx context.Context, jws *jose.JSONWebSignature) ([]byte, error) {
+	// We don't support JWTs signed with multiple signatures.
+	keyID := ""
+	for _, sig := range jws.Signatures {
+		keyID = sig.Header.KeyID
+		break
+	}
+
+	keys, expiry := r.keysFromCache()
+
+	// Don't check expiry yet. This optimizes for when the provider is unavailable.
+	for _, key := range keys {
+		if keyID == "" || key.KeyID == keyID {
+			if payload, err := jws.Verify(&key); err == nil {
+				return payload, nil
+			}
+		}
+	}
+
+	if !r.now().Add(keysExpiryDelta).After(expiry) {
+		// Keys haven't expired, don't refresh.
+		return nil, errors.New("failed to verify id token signature")
+	}
+
+	keys, err := r.keysFromRemote(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("fetching keys %v", err)
+	}
+
+	for _, key := range keys {
+		if keyID == "" || key.KeyID == keyID {
+			if payload, err := jws.Verify(&key); err == nil {
+				return payload, nil
+			}
+		}
+	}
+	return nil, errors.New("failed to verify id token signature")
+}
+
+func (r *remoteKeySet) keysFromCache() (keys []jose.JSONWebKey, expiry time.Time) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	return r.cachedKeys, r.expiry
+}
+
+// keysFromRemote syncs the key set from the remote set, records the values in the
+// cache, and returns the key set.
+func (r *remoteKeySet) keysFromRemote(ctx context.Context) ([]jose.JSONWebKey, error) {
+	// Need to lock to inspect the inflight request field.
+	r.mu.Lock()
+	// If there's not a current inflight request, create one.
+	if r.inflight == nil {
+		r.inflight = newInflight()
+
+		// This goroutine has exclusive ownership over the current inflight
+		// request. It releases the resource by nil'ing the inflight field
+		// once the goroutine is done.
+		go func() {
+			// Sync keys and finish inflight when that's done.
+			keys, expiry, err := r.updateKeys()
+
+			r.inflight.done(keys, err)
+
+			// Lock to update the keys and indicate that there is no longer an
+			// inflight request.
+			r.mu.Lock()
+			defer r.mu.Unlock()
+
+			if err == nil {
+				r.cachedKeys = keys
+				r.expiry = expiry
+			}
+
+			// Free inflight so a different request can run.
+			r.inflight = nil
+		}()
+	}
+	inflight := r.inflight
+	r.mu.Unlock()
+
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	case <-inflight.wait():
+		return inflight.result()
+	}
+}
+
+func (r *remoteKeySet) updateKeys() ([]jose.JSONWebKey, time.Time, error) {
+	req, err := http.NewRequest("GET", r.jwksURL, nil)
+	if err != nil {
+		return nil, time.Time{}, fmt.Errorf("oidc: can't create request: %v", err)
+	}
+
+	resp, err := doRequest(r.ctx, req)
+	if err != nil {
+		return nil, time.Time{}, fmt.Errorf("oidc: get keys failed %v", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := ioutil.ReadAll(resp.Body)
+	if err != nil {
+		return nil, time.Time{}, fmt.Errorf("unable to read response body: %v", err)
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, time.Time{}, fmt.Errorf("oidc: get keys failed: %s %s", resp.Status, body)
+	}
+
+	var keySet jose.JSONWebKeySet
+	err = unmarshalResp(resp, body, &keySet)
+	if err != nil {
+		return nil, time.Time{}, fmt.Errorf("oidc: failed to decode keys: %v %s", err, body)
+	}
+
+	// If the server doesn't provide cache control headers, assume the
+	// keys expire immediately.
+	expiry := r.now()
+
+	_, e, err := cachecontrol.CachableResponse(req, resp, cachecontrol.Options{})
+	if err == nil && e.After(expiry) {
+		expiry = e
+	}
+	return keySet.Keys, expiry, nil
+}
diff --git a/vendor/github.com/coreos/go-oidc/jwks_test.go b/vendor/github.com/coreos/go-oidc/jwks_test.go
new file mode 100644
index 0000000..6226117
--- /dev/null
+++ b/vendor/github.com/coreos/go-oidc/jwks_test.go
@@ -0,0 +1,250 @@
+package oidc
+
+import (
+	"bytes"
+	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/rsa"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"testing"
+	"time"
+
+	jose "gopkg.in/square/go-jose.v2"
+)
+
+type keyServer struct {
+	keys       jose.JSONWebKeySet
+	setHeaders func(h http.Header)
+}
+
+func (k *keyServer) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	if k.setHeaders != nil {
+		k.setHeaders(w.Header())
+	}
+	if err := json.NewEncoder(w).Encode(k.keys); err != nil {
+		panic(err)
+	}
+}
+
+type signingKey struct {
+	keyID string // optional
+	priv  interface{}
+	pub   interface{}
+	alg   jose.SignatureAlgorithm
+}
+
+// sign creates a JWS using the private key from the provided payload.
+func (s *signingKey) sign(t *testing.T, payload []byte) string {
+	privKey := &jose.JSONWebKey{Key: s.priv, Algorithm: string(s.alg), KeyID: s.keyID}
+
+	signer, err := jose.NewSigner(jose.SigningKey{Algorithm: s.alg, Key: privKey}, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	jws, err := signer.Sign(payload)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	data, err := jws.CompactSerialize()
+	if err != nil {
+		t.Fatal(err)
+	}
+	return data
+}
+
+// jwk returns the public part of the signing key.
+func (s *signingKey) jwk() jose.JSONWebKey {
+	return jose.JSONWebKey{Key: s.pub, Use: "sig", Algorithm: string(s.alg), KeyID: s.keyID}
+}
+
+func newRSAKey(t *testing.T) *signingKey {
+	priv, err := rsa.GenerateKey(rand.Reader, 1028)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return &signingKey{"", priv, priv.Public(), jose.RS256}
+}
+
+func newECDSAKey(t *testing.T) *signingKey {
+	priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return &signingKey{"", priv, priv.Public(), jose.ES256}
+}
+
+func TestRSAVerify(t *testing.T) {
+	good := newRSAKey(t)
+	bad := newRSAKey(t)
+
+	testKeyVerify(t, good, bad, good)
+}
+
+func TestECDSAVerify(t *testing.T) {
+	good := newECDSAKey(t)
+	bad := newECDSAKey(t)
+	testKeyVerify(t, good, bad, good)
+}
+
+func TestMultipleKeysVerify(t *testing.T) {
+	key1 := newRSAKey(t)
+	key2 := newRSAKey(t)
+	bad := newECDSAKey(t)
+
+	key1.keyID = "key1"
+	key2.keyID = "key2"
+	bad.keyID = "key3"
+
+	testKeyVerify(t, key2, bad, key1, key2)
+}
+
+func TestMismatchedKeyID(t *testing.T) {
+	key1 := newRSAKey(t)
+	key2 := newRSAKey(t)
+
+	// shallow copy
+	bad := new(signingKey)
+	*bad = *key1
+
+	// The bad key is a valid key this time, but has a different Key ID.
+	// It shouldn't match key1 because of the mismatched ID, even though
+	// it would confirm the signature just fine.
+	bad.keyID = "key3"
+
+	key1.keyID = "key1"
+	key2.keyID = "key2"
+
+	testKeyVerify(t, key2, bad, key1, key2)
+}
+
+func testKeyVerify(t *testing.T, good, bad *signingKey, verification ...*signingKey) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	keySet := jose.JSONWebKeySet{}
+	for _, v := range verification {
+		keySet.Keys = append(keySet.Keys, v.jwk())
+	}
+
+	payload := []byte("a secret")
+
+	jws, err := jose.ParseSigned(good.sign(t, payload))
+	if err != nil {
+		t.Fatal(err)
+	}
+	badJWS, err := jose.ParseSigned(bad.sign(t, payload))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	s := httptest.NewServer(&keyServer{keys: keySet})
+	defer s.Close()
+
+	rks := newRemoteKeySet(ctx, s.URL, nil)
+
+	// Ensure the token verifies.
+	gotPayload, err := rks.verify(ctx, jws)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Equal(gotPayload, payload) {
+		t.Errorf("expected payload %s got %s", payload, gotPayload)
+	}
+
+	// Ensure the token verifies from the cache.
+	gotPayload, err = rks.verify(ctx, jws)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Equal(gotPayload, payload) {
+		t.Errorf("expected payload %s got %s", payload, gotPayload)
+	}
+
+	// Ensure item signed by wrong token doesn't verify.
+	if _, err := rks.verify(context.Background(), badJWS); err == nil {
+		t.Errorf("incorrectly verified signature")
+	}
+}
+
+func TestCacheControl(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	key1 := newRSAKey(t)
+	key2 := newRSAKey(t)
+
+	key1.keyID = "key1"
+	key2.keyID = "key2"
+
+	payload := []byte("a secret")
+	jws1, err := jose.ParseSigned(key1.sign(t, payload))
+	if err != nil {
+		t.Fatal(err)
+	}
+	jws2, err := jose.ParseSigned(key2.sign(t, payload))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	cacheForSeconds := 1200
+	now := time.Now()
+
+	server := &keyServer{
+		keys: jose.JSONWebKeySet{
+			Keys: []jose.JSONWebKey{key1.jwk()},
+		},
+		setHeaders: func(h http.Header) {
+			h.Set("Cache-Control", "max-age="+strconv.Itoa(cacheForSeconds))
+		},
+	}
+	s := httptest.NewServer(server)
+	defer s.Close()
+
+	rks := newRemoteKeySet(ctx, s.URL, func() time.Time { return now })
+
+	if _, err := rks.verify(ctx, jws1); err != nil {
+		t.Errorf("failed to verify valid signature: %v", err)
+	}
+	if _, err := rks.verify(ctx, jws2); err == nil {
+		t.Errorf("incorrectly verified signature")
+	}
+
+	// Add second key to public list.
+	server.keys = jose.JSONWebKeySet{
+		Keys: []jose.JSONWebKey{key1.jwk(), key2.jwk()},
+	}
+
+	if _, err := rks.verify(ctx, jws1); err != nil {
+		t.Errorf("failed to verify valid signature: %v", err)
+	}
+	if _, err := rks.verify(ctx, jws2); err == nil {
+		t.Errorf("incorrectly verified signature, still within cache limit")
+	}
+
+	// Move time forward. Remote key set should not query the remote server.
+	now = now.Add(time.Duration(cacheForSeconds) * time.Second)
+
+	if _, err := rks.verify(ctx, jws1); err != nil {
+		t.Errorf("failed to verify valid signature: %v", err)
+	}
+	if _, err := rks.verify(ctx, jws2); err != nil {
+		t.Errorf("failed to verify valid signature: %v", err)
+	}
+
+	// Kill server and move time forward again. Keys should still verify.
+	s.Close()
+	now = now.Add(time.Duration(cacheForSeconds) * time.Second)
+
+	if _, err := rks.verify(ctx, jws1); err != nil {
+		t.Errorf("failed to verify valid signature: %v", err)
+	}
+	if _, err := rks.verify(ctx, jws2); err != nil {
+		t.Errorf("failed to verify valid signature: %v", err)
+	}
+}
diff --git a/vendor/github.com/coreos/go-oidc/oidc.go b/vendor/github.com/coreos/go-oidc/oidc.go
new file mode 100644
index 0000000..c82ba46
--- /dev/null
+++ b/vendor/github.com/coreos/go-oidc/oidc.go
@@ -0,0 +1,374 @@
+// Package oidc implements OpenID Connect client logic for the golang.org/x/oauth2 package.
+package oidc
+
+import (
+	"context"
+	"crypto/sha256"
+	"crypto/sha512"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"hash"
+	"io/ioutil"
+	"mime"
+	"net/http"
+	"strings"
+	"time"
+
+	"golang.org/x/oauth2"
+	jose "gopkg.in/square/go-jose.v2"
+)
+
+const (
+	// ScopeOpenID is the mandatory scope for all OpenID Connect OAuth2 requests.
+	ScopeOpenID = "openid"
+
+	// ScopeOfflineAccess is an optional scope defined by OpenID Connect for requesting
+	// OAuth2 refresh tokens.
+	//
+	// Support for this scope differs between OpenID Connect providers. For instance
+	// Google rejects it, favoring appending "access_type=offline" as part of the
+	// authorization request instead.
+	//
+	// See: https://openid.net/specs/openid-connect-core-1_0.html#OfflineAccess
+	ScopeOfflineAccess = "offline_access"
+)
+
+var (
+	errNoAtHash      = errors.New("id token did not have an access token hash")
+	errInvalidAtHash = errors.New("access token hash does not match value in ID token")
+)
+
+// ClientContext returns a new Context that carries the provided HTTP client.
+//
+// This method sets the same context key used by the golang.org/x/oauth2 package,
+// so the returned context works for that package too.
+//
+//    myClient := &http.Client{}
+//    ctx := oidc.ClientContext(parentContext, myClient)
+//
+//    // This will use the custom client
+//    provider, err := oidc.NewProvider(ctx, "https://accounts.example.com")
+//
+func ClientContext(ctx context.Context, client *http.Client) context.Context {
+	return context.WithValue(ctx, oauth2.HTTPClient, client)
+}
+
+func doRequest(ctx context.Context, req *http.Request) (*http.Response, error) {
+	client := http.DefaultClient
+	if c, ok := ctx.Value(oauth2.HTTPClient).(*http.Client); ok {
+		client = c
+	}
+	return client.Do(req.WithContext(ctx))
+}
+
+// Provider represents an OpenID Connect server's configuration.
+type Provider struct {
+	issuer      string
+	authURL     string
+	tokenURL    string
+	userInfoURL string
+
+	// Raw claims returned by the server.
+	rawClaims []byte
+
+	remoteKeySet KeySet
+}
+
+type cachedKeys struct {
+	keys   []jose.JSONWebKey
+	expiry time.Time
+}
+
+type providerJSON struct {
+	Issuer      string `json:"issuer"`
+	AuthURL     string `json:"authorization_endpoint"`
+	TokenURL    string `json:"token_endpoint"`
+	JWKSURL     string `json:"jwks_uri"`
+	UserInfoURL string `json:"userinfo_endpoint"`
+}
+
+// NewProvider uses the OpenID Connect discovery mechanism to construct a Provider.
+//
+// The issuer is the URL identifier for the service. For example: "https://accounts.google.com"
+// or "https://login.salesforce.com".
+func NewProvider(ctx context.Context, issuer string) (*Provider, error) {
+	wellKnown := strings.TrimSuffix(issuer, "/") + "/.well-known/openid-configuration"
+	req, err := http.NewRequest("GET", wellKnown, nil)
+	if err != nil {
+		return nil, err
+	}
+	resp, err := doRequest(ctx, req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	body, err := ioutil.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("unable to read response body: %v", err)
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("%s: %s", resp.Status, body)
+	}
+
+	var p providerJSON
+	err = unmarshalResp(resp, body, &p)
+	if err != nil {
+		return nil, fmt.Errorf("oidc: failed to decode provider discovery object: %v", err)
+	}
+
+	if p.Issuer != issuer {
+		return nil, fmt.Errorf("oidc: issuer did not match the issuer returned by provider, expected %q got %q", issuer, p.Issuer)
+	}
+	return &Provider{
+		issuer:       p.Issuer,
+		authURL:      p.AuthURL,
+		tokenURL:     p.TokenURL,
+		userInfoURL:  p.UserInfoURL,
+		rawClaims:    body,
+		remoteKeySet: NewRemoteKeySet(ctx, p.JWKSURL),
+	}, nil
+}
+
+// Claims unmarshals raw fields returned by the server during discovery.
+//
+//    var claims struct {
+//        ScopesSupported []string `json:"scopes_supported"`
+//        ClaimsSupported []string `json:"claims_supported"`
+//    }
+//
+//    if err := provider.Claims(&claims); err != nil {
+//        // handle unmarshaling error
+//    }
+//
+// For a list of fields defined by the OpenID Connect spec see:
+// https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata
+func (p *Provider) Claims(v interface{}) error {
+	if p.rawClaims == nil {
+		return errors.New("oidc: claims not set")
+	}
+	return json.Unmarshal(p.rawClaims, v)
+}
+
+// Endpoint returns the OAuth2 auth and token endpoints for the given provider.
+func (p *Provider) Endpoint() oauth2.Endpoint {
+	return oauth2.Endpoint{AuthURL: p.authURL, TokenURL: p.tokenURL}
+}
+
+// UserInfo represents the OpenID Connect userinfo claims.
+type UserInfo struct {
+	Subject       string `json:"sub"`
+	Profile       string `json:"profile"`
+	Email         string `json:"email"`
+	EmailVerified bool   `json:"email_verified"`
+
+	claims []byte
+}
+
+// Claims unmarshals the raw JSON object claims into the provided object.
+func (u *UserInfo) Claims(v interface{}) error {
+	if u.claims == nil {
+		return errors.New("oidc: claims not set")
+	}
+	return json.Unmarshal(u.claims, v)
+}
+
+// UserInfo uses the token source to query the provider's user info endpoint.
+func (p *Provider) UserInfo(ctx context.Context, tokenSource oauth2.TokenSource) (*UserInfo, error) {
+	if p.userInfoURL == "" {
+		return nil, errors.New("oidc: user info endpoint is not supported by this provider")
+	}
+
+	req, err := http.NewRequest("GET", p.userInfoURL, nil)
+	if err != nil {
+		return nil, fmt.Errorf("oidc: create GET request: %v", err)
+	}
+
+	token, err := tokenSource.Token()
+	if err != nil {
+		return nil, fmt.Errorf("oidc: get access token: %v", err)
+	}
+	token.SetAuthHeader(req)
+
+	resp, err := doRequest(ctx, req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+	body, err := ioutil.ReadAll(resp.Body)
+	if err != nil {
+		return nil, err
+	}
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("%s: %s", resp.Status, body)
+	}
+
+	var userInfo UserInfo
+	if err := json.Unmarshal(body, &userInfo); err != nil {
+		return nil, fmt.Errorf("oidc: failed to decode userinfo: %v", err)
+	}
+	userInfo.claims = body
+	return &userInfo, nil
+}
+
+// IDToken is an OpenID Connect extension that provides a predictable representation
+// of an authorization event.
+//
+// The ID Token only holds fields OpenID Connect requires. To access additional
+// claims returned by the server, use the Claims method.
+type IDToken struct {
+	// The URL of the server which issued this token. OpenID Connect
+	// requires this value always be identical to the URL used for
+	// initial discovery.
+	//
+	// Note: Because of a known issue with Google Accounts' implementation
+	// this value may differ when using Google.
+	//
+	// See: https://developers.google.com/identity/protocols/OpenIDConnect#obtainuserinfo
+	Issuer string
+
+	// The client ID, or set of client IDs, that this token is issued for. For
+	// common uses, this is the client that initialized the auth flow.
+	//
+	// This package ensures the audience contains an expected value.
+	Audience []string
+
+	// A unique string which identifies the end user.
+	Subject string
+
+	// Expiry of the token. Ths package will not process tokens that have
+	// expired unless that validation is explicitly turned off.
+	Expiry time.Time
+	// When the token was issued by the provider.
+	IssuedAt time.Time
+
+	// Initial nonce provided during the authentication redirect.
+	//
+	// This package does NOT provided verification on the value of this field
+	// and it's the user's responsibility to ensure it contains a valid value.
+	Nonce string
+
+	// at_hash claim, if set in the ID token. Callers can verify an access token
+	// that corresponds to the ID token using the VerifyAccessToken method.
+	AccessTokenHash string
+
+	// signature algorithm used for ID token, needed to compute a verification hash of an
+	// access token
+	sigAlgorithm string
+
+	// Raw payload of the id_token.
+	claims []byte
+}
+
+// Claims unmarshals the raw JSON payload of the ID Token into a provided struct.
+//
+//		idToken, err := idTokenVerifier.Verify(rawIDToken)
+//		if err != nil {
+//			// handle error
+//		}
+//		var claims struct {
+//			Email         string `json:"email"`
+//			EmailVerified bool   `json:"email_verified"`
+//		}
+//		if err := idToken.Claims(&claims); err != nil {
+//			// handle error
+//		}
+//
+func (i *IDToken) Claims(v interface{}) error {
+	if i.claims == nil {
+		return errors.New("oidc: claims not set")
+	}
+	return json.Unmarshal(i.claims, v)
+}
+
+// VerifyAccessToken verifies that the hash of the access token that corresponds to the iD token
+// matches the hash in the id token. It returns an error if the hashes  don't match.
+// It is the caller's responsibility to ensure that the optional access token hash is present for the ID token
+// before calling this method. See https://openid.net/specs/openid-connect-core-1_0.html#CodeIDToken
+func (i *IDToken) VerifyAccessToken(accessToken string) error {
+	if i.AccessTokenHash == "" {
+		return errNoAtHash
+	}
+	var h hash.Hash
+	switch i.sigAlgorithm {
+	case RS256, ES256, PS256:
+		h = sha256.New()
+	case RS384, ES384, PS384:
+		h = sha512.New384()
+	case RS512, ES512, PS512:
+		h = sha512.New()
+	default:
+		return fmt.Errorf("oidc: unsupported signing algorithm %q", i.sigAlgorithm)
+	}
+	h.Write([]byte(accessToken)) // hash documents that Write will never return an error
+	sum := h.Sum(nil)[:h.Size()/2]
+	actual := base64.RawURLEncoding.EncodeToString(sum)
+	if actual != i.AccessTokenHash {
+		return errInvalidAtHash
+	}
+	return nil
+}
+
+type idToken struct {
+	Issuer   string   `json:"iss"`
+	Subject  string   `json:"sub"`
+	Audience audience `json:"aud"`
+	Expiry   jsonTime `json:"exp"`
+	IssuedAt jsonTime `json:"iat"`
+	Nonce    string   `json:"nonce"`
+	AtHash   string   `json:"at_hash"`
+}
+
+type audience []string
+
+func (a *audience) UnmarshalJSON(b []byte) error {
+	var s string
+	if json.Unmarshal(b, &s) == nil {
+		*a = audience{s}
+		return nil
+	}
+	var auds []string
+	if err := json.Unmarshal(b, &auds); err != nil {
+		return err
+	}
+	*a = audience(auds)
+	return nil
+}
+
+type jsonTime time.Time
+
+func (j *jsonTime) UnmarshalJSON(b []byte) error {
+	var n json.Number
+	if err := json.Unmarshal(b, &n); err != nil {
+		return err
+	}
+	var unix int64
+
+	if t, err := n.Int64(); err == nil {
+		unix = t
+	} else {
+		f, err := n.Float64()
+		if err != nil {
+			return err
+		}
+		unix = int64(f)
+	}
+	*j = jsonTime(time.Unix(unix, 0))
+	return nil
+}
+
+func unmarshalResp(r *http.Response, body []byte, v interface{}) error {
+	err := json.Unmarshal(body, &v)
+	if err == nil {
+		return nil
+	}
+	ct := r.Header.Get("Content-Type")
+	mediaType, _, parseErr := mime.ParseMediaType(ct)
+	if parseErr == nil && mediaType == "application/json" {
+		return fmt.Errorf("got Content-Type = application/json, but could not unmarshal as JSON: %v", err)
+	}
+	return fmt.Errorf("expected Content-Type = application/json, got %q: %v", ct, err)
+}
diff --git a/vendor/github.com/coreos/go-oidc/oidc_test.go b/vendor/github.com/coreos/go-oidc/oidc_test.go
new file mode 100644
index 0000000..1a2f07a
--- /dev/null
+++ b/vendor/github.com/coreos/go-oidc/oidc_test.go
@@ -0,0 +1,95 @@
+package oidc
+
+import (
+	"fmt"
+	"testing"
+)
+
+const (
+	// at_hash value and access_token returned by Google.
+	googleAccessTokenHash = "piwt8oCH-K2D9pXlaS1Y-w"
+	googleAccessToken     = "ya29.CjHSA1l5WUn8xZ6HanHFzzdHdbXm-14rxnC7JHch9eFIsZkQEGoWzaYG4o7k5f6BnPLj"
+	googleSigningAlg      = RS256
+	// following values computed by own algo for regression testing
+	computed384TokenHash = "_ILKVQjbEzFKNJjUKC2kz9eReYi0A9Of"
+	computed512TokenHash = "Spa_APgwBrarSeQbxI-rbragXho6dqFpH5x9PqaPfUI"
+)
+
+type accessTokenTest struct {
+	name        string
+	tok         *IDToken
+	accessToken string
+	verifier    func(err error) error
+}
+
+func (a accessTokenTest) run(t *testing.T) {
+	err := a.tok.VerifyAccessToken(a.accessToken)
+	result := a.verifier(err)
+	if result != nil {
+		t.Error(result)
+	}
+}
+
+func TestAccessTokenVerification(t *testing.T) {
+	newToken := func(alg, atHash string) *IDToken {
+		return &IDToken{sigAlgorithm: alg, AccessTokenHash: atHash}
+	}
+	assertNil := func(err error) error {
+		if err != nil {
+			return fmt.Errorf("want nil error, got %v", err)
+		}
+		return nil
+	}
+	assertMsg := func(msg string) func(err error) error {
+		return func(err error) error {
+			if err == nil {
+				return fmt.Errorf("expected error, got success")
+			}
+			if err.Error() != msg {
+				return fmt.Errorf("bad error message, %q, (want %q)", err.Error(), msg)
+			}
+			return nil
+		}
+	}
+	tests := []accessTokenTest{
+		{
+			"goodRS256",
+			newToken(googleSigningAlg, googleAccessTokenHash),
+			googleAccessToken,
+			assertNil,
+		},
+		{
+			"goodES384",
+			newToken("ES384", computed384TokenHash),
+			googleAccessToken,
+			assertNil,
+		},
+		{
+			"goodPS512",
+			newToken("PS512", computed512TokenHash),
+			googleAccessToken,
+			assertNil,
+		},
+		{
+			"badRS256",
+			newToken("RS256", computed512TokenHash),
+			googleAccessToken,
+			assertMsg("access token hash does not match value in ID token"),
+		},
+		{
+			"nohash",
+			newToken("RS256", ""),
+			googleAccessToken,
+			assertMsg("id token did not have an access token hash"),
+		},
+		{
+			"badSignAlgo",
+			newToken("none", "xxx"),
+			googleAccessToken,
+			assertMsg(`oidc: unsupported signing algorithm "none"`),
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, test.run)
+	}
+}
diff --git a/vendor/github.com/coreos/go-oidc/test b/vendor/github.com/coreos/go-oidc/test
new file mode 100755
index 0000000..b262d0e
--- /dev/null
+++ b/vendor/github.com/coreos/go-oidc/test
@@ -0,0 +1,16 @@
+#!/bin/bash
+
+set -e
+
+# Filter out any files with a !golint build tag.
+LINTABLE=$( go list -tags=golint -f '
+  {{- range $i, $file := .GoFiles -}}
+    {{ $file }} {{ end }}
+  {{ range $i, $file := .TestGoFiles -}}
+    {{ $file }} {{ end }}' github.com/coreos/go-oidc )
+
+go test -v -i -race github.com/coreos/go-oidc/...
+go test -v -race github.com/coreos/go-oidc/...
+golint -set_exit_status $LINTABLE
+go vet github.com/coreos/go-oidc/...
+go build -v ./example/...
diff --git a/vendor/github.com/coreos/go-oidc/verify.go b/vendor/github.com/coreos/go-oidc/verify.go
new file mode 100644
index 0000000..24ff73e
--- /dev/null
+++ b/vendor/github.com/coreos/go-oidc/verify.go
@@ -0,0 +1,243 @@
+package oidc
+
+import (
+	"bytes"
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	"golang.org/x/oauth2"
+	jose "gopkg.in/square/go-jose.v2"
+)
+
+const (
+	issuerGoogleAccounts         = "https://accounts.google.com"
+	issuerGoogleAccountsNoScheme = "accounts.google.com"
+)
+
+// KeySet is a set of publc JSON Web Keys that can be used to validate the signature
+// of JSON web tokens. This is expected to be backed by a remote key set through
+// provider metadata discovery or an in-memory set of keys delivered out-of-band.
+type KeySet interface {
+	// VerifySignature parses the JSON web token, verifies the signature, and returns
+	// the raw payload. Header and claim fields are validated by other parts of the
+	// package. For example, the KeySet does not need to check values such as signature
+	// algorithm, issuer, and audience since the IDTokenVerifier validates these values
+	// independently.
+	//
+	// If VerifySignature makes HTTP requests to verify the token, it's expected to
+	// use any HTTP client associated with the context through ClientContext.
+	VerifySignature(ctx context.Context, jwt string) (payload []byte, err error)
+}
+
+// IDTokenVerifier provides verification for ID Tokens.
+type IDTokenVerifier struct {
+	keySet KeySet
+	config *Config
+	issuer string
+}
+
+// NewVerifier returns a verifier manually constructed from a key set and issuer URL.
+//
+// It's easier to use provider discovery to construct an IDTokenVerifier than creating
+// one directly. This method is intended to be used with provider that don't support
+// metadata discovery, or avoiding round trips when the key set URL is already known.
+//
+// This constructor can be used to create a verifier directly using the issuer URL and
+// JSON Web Key Set URL without using discovery:
+//
+//		keySet := oidc.NewRemoteKeySet(ctx, "https://www.googleapis.com/oauth2/v3/certs")
+//		verifier := oidc.NewVerifier("https://accounts.google.com", keySet, config)
+//
+// Since KeySet is an interface, this constructor can also be used to supply custom
+// public key sources. For example, if a user wanted to supply public keys out-of-band
+// and hold them statically in-memory:
+//
+//		// Custom KeySet implementation.
+//		keySet := newStatisKeySet(publicKeys...)
+//
+//		// Verifier uses the custom KeySet implementation.
+//		verifier := oidc.NewVerifier("https://auth.example.com", keySet, config)
+//
+func NewVerifier(issuerURL string, keySet KeySet, config *Config) *IDTokenVerifier {
+	return &IDTokenVerifier{keySet: keySet, config: config, issuer: issuerURL}
+}
+
+// Config is the configuration for an IDTokenVerifier.
+type Config struct {
+	// Expected audience of the token. For a majority of the cases this is expected to be
+	// the ID of the client that initialized the login flow. It may occasionally differ if
+	// the provider supports the authorizing party (azp) claim.
+	//
+	// If not provided, users must explicitly set SkipClientIDCheck.
+	ClientID string
+	// If specified, only this set of algorithms may be used to sign the JWT.
+	//
+	// Since many providers only support RS256, SupportedSigningAlgs defaults to this value.
+	SupportedSigningAlgs []string
+
+	// If true, no ClientID check performed. Must be true if ClientID field is empty.
+	SkipClientIDCheck bool
+	// If true, token expiry is not checked.
+	SkipExpiryCheck bool
+
+	// Time function to check Token expiry. Defaults to time.Now
+	Now func() time.Time
+}
+
+// Verifier returns an IDTokenVerifier that uses the provider's key set to verify JWTs.
+//
+// The returned IDTokenVerifier is tied to the Provider's context and its behavior is
+// undefined once the Provider's context is canceled.
+func (p *Provider) Verifier(config *Config) *IDTokenVerifier {
+	return NewVerifier(p.issuer, p.remoteKeySet, config)
+}
+
+func parseJWT(p string) ([]byte, error) {
+	parts := strings.Split(p, ".")
+	if len(parts) < 2 {
+		return nil, fmt.Errorf("oidc: malformed jwt, expected 3 parts got %d", len(parts))
+	}
+	payload, err := base64.RawURLEncoding.DecodeString(parts[1])
+	if err != nil {
+		return nil, fmt.Errorf("oidc: malformed jwt payload: %v", err)
+	}
+	return payload, nil
+}
+
+func contains(sli []string, ele string) bool {
+	for _, s := range sli {
+		if s == ele {
+			return true
+		}
+	}
+	return false
+}
+
+// Verify parses a raw ID Token, verifies it's been signed by the provider, preforms
+// any additional checks depending on the Config, and returns the payload.
+//
+// Verify does NOT do nonce validation, which is the callers responsibility.
+//
+// See: https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation
+//
+//    oauth2Token, err := oauth2Config.Exchange(ctx, r.URL.Query().Get("code"))
+//    if err != nil {
+//        // handle error
+//    }
+//
+//    // Extract the ID Token from oauth2 token.
+//    rawIDToken, ok := oauth2Token.Extra("id_token").(string)
+//    if !ok {
+//        // handle error
+//    }
+//
+//    token, err := verifier.Verify(ctx, rawIDToken)
+//
+func (v *IDTokenVerifier) Verify(ctx context.Context, rawIDToken string) (*IDToken, error) {
+	jws, err := jose.ParseSigned(rawIDToken)
+	if err != nil {
+		return nil, fmt.Errorf("oidc: malformed jwt: %v", err)
+	}
+
+	// Throw out tokens with invalid claims before trying to verify the token. This lets
+	// us do cheap checks before possibly re-syncing keys.
+	payload, err := parseJWT(rawIDToken)
+	if err != nil {
+		return nil, fmt.Errorf("oidc: malformed jwt: %v", err)
+	}
+	var token idToken
+	if err := json.Unmarshal(payload, &token); err != nil {
+		return nil, fmt.Errorf("oidc: failed to unmarshal claims: %v", err)
+	}
+
+	t := &IDToken{
+		Issuer:          token.Issuer,
+		Subject:         token.Subject,
+		Audience:        []string(token.Audience),
+		Expiry:          time.Time(token.Expiry),
+		IssuedAt:        time.Time(token.IssuedAt),
+		Nonce:           token.Nonce,
+		AccessTokenHash: token.AtHash,
+		claims:          payload,
+	}
+
+	// Check issuer.
+	if t.Issuer != v.issuer {
+		// Google sometimes returns "accounts.google.com" as the issuer claim instead of
+		// the required "https://accounts.google.com". Detect this case and allow it only
+		// for Google.
+		//
+		// We will not add hooks to let other providers go off spec like this.
+		if !(v.issuer == issuerGoogleAccounts && t.Issuer == issuerGoogleAccountsNoScheme) {
+			return nil, fmt.Errorf("oidc: id token issued by a different provider, expected %q got %q", v.issuer, t.Issuer)
+		}
+	}
+
+	// If a client ID has been provided, make sure it's part of the audience. SkipClientIDCheck must be true if ClientID is empty.
+	//
+	// This check DOES NOT ensure that the ClientID is the party to which the ID Token was issued (i.e. Authorized party).
+	if !v.config.SkipClientIDCheck {
+		if v.config.ClientID != "" {
+			if !contains(t.Audience, v.config.ClientID) {
+				return nil, fmt.Errorf("oidc: expected audience %q got %q", v.config.ClientID, t.Audience)
+			}
+		} else {
+			return nil, fmt.Errorf("oidc: invalid configuration, clientID must be provided or SkipClientIDCheck must be set")
+		}
+	}
+
+	// If a SkipExpiryCheck is false, make sure token is not expired.
+	if !v.config.SkipExpiryCheck {
+		now := time.Now
+		if v.config.Now != nil {
+			now = v.config.Now
+		}
+
+		if t.Expiry.Before(now()) {
+			return nil, fmt.Errorf("oidc: token is expired (Token Expiry: %v)", t.Expiry)
+		}
+	}
+
+	switch len(jws.Signatures) {
+	case 0:
+		return nil, fmt.Errorf("oidc: id token not signed")
+	case 1:
+	default:
+		return nil, fmt.Errorf("oidc: multiple signatures on id token not supported")
+	}
+
+	sig := jws.Signatures[0]
+	supportedSigAlgs := v.config.SupportedSigningAlgs
+	if len(supportedSigAlgs) == 0 {
+		supportedSigAlgs = []string{RS256}
+	}
+
+	if !contains(supportedSigAlgs, sig.Header.Algorithm) {
+		return nil, fmt.Errorf("oidc: id token signed with unsupported algorithm, expected %q got %q", supportedSigAlgs, sig.Header.Algorithm)
+	}
+
+	t.sigAlgorithm = sig.Header.Algorithm
+
+	gotPayload, err := v.keySet.VerifySignature(ctx, rawIDToken)
+	if err != nil {
+		return nil, fmt.Errorf("failed to verify signature: %v", err)
+	}
+
+	// Ensure that the payload returned by the square actually matches the payload parsed earlier.
+	if !bytes.Equal(gotPayload, payload) {
+		return nil, errors.New("oidc: internal error, payload parsed did not match previous payload")
+	}
+
+	return t, nil
+}
+
+// Nonce returns an auth code option which requires the ID Token created by the
+// OpenID Connect provider to contain the specified nonce.
+func Nonce(nonce string) oauth2.AuthCodeOption {
+	return oauth2.SetAuthURLParam("nonce", nonce)
+}
diff --git a/vendor/github.com/coreos/go-oidc/verify_test.go b/vendor/github.com/coreos/go-oidc/verify_test.go
new file mode 100644
index 0000000..ff821af
--- /dev/null
+++ b/vendor/github.com/coreos/go-oidc/verify_test.go
@@ -0,0 +1,272 @@
+package oidc
+
+import (
+	"context"
+	"fmt"
+	"strconv"
+	"testing"
+	"time"
+
+	jose "gopkg.in/square/go-jose.v2"
+)
+
+type testVerifier struct {
+	jwk jose.JSONWebKey
+}
+
+func (t *testVerifier) VerifySignature(ctx context.Context, jwt string) ([]byte, error) {
+	jws, err := jose.ParseSigned(jwt)
+	if err != nil {
+		return nil, fmt.Errorf("oidc: malformed jwt: %v", err)
+	}
+	return jws.Verify(&t.jwk)
+}
+
+func TestVerify(t *testing.T) {
+	tests := []verificationTest{
+		{
+			name:    "good token",
+			idToken: `{"iss":"https://foo"}`,
+			config: Config{
+				SkipClientIDCheck: true,
+				SkipExpiryCheck:   true,
+			},
+			signKey: newRSAKey(t),
+		},
+		{
+			name:    "invalid issuer",
+			issuer:  "https://bar",
+			idToken: `{"iss":"https://foo"}`,
+			config: Config{
+				SkipClientIDCheck: true,
+				SkipExpiryCheck:   true,
+			},
+			signKey: newRSAKey(t),
+			wantErr: true,
+		},
+		{
+			name:    "invalid sig",
+			idToken: `{"iss":"https://foo"}`,
+			config: Config{
+				SkipClientIDCheck: true,
+				SkipExpiryCheck:   true,
+			},
+			signKey:         newRSAKey(t),
+			verificationKey: newRSAKey(t),
+			wantErr:         true,
+		},
+		{
+			name:    "google accounts without scheme",
+			issuer:  "https://accounts.google.com",
+			idToken: `{"iss":"accounts.google.com"}`,
+			config: Config{
+				SkipClientIDCheck: true,
+				SkipExpiryCheck:   true,
+			},
+			signKey: newRSAKey(t),
+		},
+		{
+			name:    "expired token",
+			idToken: `{"iss":"https://foo","exp":` + strconv.FormatInt(time.Now().Add(-time.Hour).Unix(), 10) + `}`,
+			config: Config{
+				SkipClientIDCheck: true,
+			},
+			signKey: newRSAKey(t),
+			wantErr: true,
+		},
+		{
+			name:    "unexpired token",
+			idToken: `{"iss":"https://foo","exp":` + strconv.FormatInt(time.Now().Add(time.Hour).Unix(), 10) + `}`,
+			config: Config{
+				SkipClientIDCheck: true,
+			},
+			signKey: newRSAKey(t),
+		},
+		{
+			name: "expiry as float",
+			idToken: `{"iss":"https://foo","exp":` +
+				strconv.FormatFloat(float64(time.Now().Add(time.Hour).Unix()), 'E', -1, 64) +
+				`}`,
+			config: Config{
+				SkipClientIDCheck: true,
+			},
+			signKey: newRSAKey(t),
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, test.run)
+	}
+}
+
+func TestVerifyAudience(t *testing.T) {
+	tests := []verificationTest{
+		{
+			name:    "good audience",
+			idToken: `{"iss":"https://foo","aud":"client1"}`,
+			config: Config{
+				ClientID:        "client1",
+				SkipExpiryCheck: true,
+			},
+			signKey: newRSAKey(t),
+		},
+		{
+			name:    "mismatched audience",
+			idToken: `{"iss":"https://foo","aud":"client2"}`,
+			config: Config{
+				ClientID:        "client1",
+				SkipExpiryCheck: true,
+			},
+			signKey: newRSAKey(t),
+			wantErr: true,
+		},
+		{
+			name:    "multiple audiences, one matches",
+			idToken: `{"iss":"https://foo","aud":["client1","client2"]}`,
+			config: Config{
+				ClientID:        "client2",
+				SkipExpiryCheck: true,
+			},
+			signKey: newRSAKey(t),
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, test.run)
+	}
+}
+
+func TestVerifySigningAlg(t *testing.T) {
+	tests := []verificationTest{
+		{
+			name:    "default signing alg",
+			idToken: `{"iss":"https://foo"}`,
+			config: Config{
+				SkipClientIDCheck: true,
+				SkipExpiryCheck:   true,
+			},
+			signKey: newRSAKey(t),
+		},
+		{
+			name:    "bad signing alg",
+			idToken: `{"iss":"https://foo"}`,
+			config: Config{
+				SkipClientIDCheck: true,
+				SkipExpiryCheck:   true,
+			},
+			signKey: newECDSAKey(t),
+			wantErr: true,
+		},
+		{
+			name:    "ecdsa signing",
+			idToken: `{"iss":"https://foo"}`,
+			config: Config{
+				SupportedSigningAlgs: []string{ES256},
+				SkipClientIDCheck:    true,
+				SkipExpiryCheck:      true,
+			},
+			signKey: newECDSAKey(t),
+		},
+		{
+			name:    "one of many supported",
+			idToken: `{"iss":"https://foo"}`,
+			config: Config{
+				SkipClientIDCheck:    true,
+				SkipExpiryCheck:      true,
+				SupportedSigningAlgs: []string{RS256, ES256},
+			},
+			signKey: newECDSAKey(t),
+		},
+		{
+			name:    "not in requiredAlgs",
+			idToken: `{"iss":"https://foo"}`,
+			config: Config{
+				SupportedSigningAlgs: []string{RS256, ES512},
+				SkipClientIDCheck:    true,
+				SkipExpiryCheck:      true,
+			},
+			signKey: newECDSAKey(t),
+			wantErr: true,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, test.run)
+	}
+}
+
+func TestAccessTokenHash(t *testing.T) {
+	atHash := "piwt8oCH-K2D9pXlaS1Y-w"
+	vt := verificationTest{
+		name:    "preserves token hash and sig algo",
+		idToken: `{"iss":"https://foo","aud":"client1", "at_hash": "` + atHash + `"}`,
+		config: Config{
+			ClientID:        "client1",
+			SkipExpiryCheck: true,
+		},
+		signKey: newRSAKey(t),
+	}
+	t.Run("at_hash", func(t *testing.T) {
+		tok := vt.runGetToken(t)
+		if tok != nil {
+			if tok.AccessTokenHash != atHash {
+				t.Errorf("access token hash not preserved correctly, want %q got %q", atHash, tok.AccessTokenHash)
+			}
+			if tok.sigAlgorithm != RS256 {
+				t.Errorf("invalid signature algo, want %q got %q", RS256, tok.sigAlgorithm)
+			}
+		}
+	})
+}
+
+type verificationTest struct {
+	// Name of the subtest.
+	name string
+
+	// If not provided defaults to "https://foo"
+	issuer string
+
+	// JWT payload (just the claims).
+	idToken string
+
+	// Key to sign the ID Token with.
+	signKey *signingKey
+	// If not provided defaults to signKey. Only useful when
+	// testing invalid signatures.
+	verificationKey *signingKey
+
+	config  Config
+	wantErr bool
+}
+
+func (v verificationTest) runGetToken(t *testing.T) *IDToken {
+	token := v.signKey.sign(t, []byte(v.idToken))
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	issuer := "https://foo"
+	if v.issuer != "" {
+		issuer = v.issuer
+	}
+	var ks KeySet
+	if v.verificationKey == nil {
+		ks = &testVerifier{v.signKey.jwk()}
+	} else {
+		ks = &testVerifier{v.verificationKey.jwk()}
+	}
+	verifier := NewVerifier(issuer, ks, &v.config)
+
+	idToken, err := verifier.Verify(ctx, token)
+	if err != nil {
+		if !v.wantErr {
+			t.Errorf("%s: verify %v", v.name, err)
+		}
+	} else {
+		if v.wantErr {
+			t.Errorf("%s: expected error", v.name)
+		}
+	}
+	return idToken
+}
+
+func (v verificationTest) run(t *testing.T) {
+	v.runGetToken(t)
+}
diff --git a/vendor/github.com/pquerna/cachecontrol/.travis.yml b/vendor/github.com/pquerna/cachecontrol/.travis.yml
new file mode 100644
index 0000000..f140b49
--- /dev/null
+++ b/vendor/github.com/pquerna/cachecontrol/.travis.yml
@@ -0,0 +1,10 @@
+language: go
+
+install:
+  - go get -d -v ./...
+  - go get -u github.com/stretchr/testify/require
+
+go:
+  - 1.7
+  - 1.8
+  - tip
diff --git a/vendor/github.com/pquerna/cachecontrol/LICENSE b/vendor/github.com/pquerna/cachecontrol/LICENSE
new file mode 100644
index 0000000..d645695
--- /dev/null
+++ b/vendor/github.com/pquerna/cachecontrol/LICENSE
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/vendor/github.com/pquerna/cachecontrol/README.md b/vendor/github.com/pquerna/cachecontrol/README.md
new file mode 100644
index 0000000..da0b428
--- /dev/null
+++ b/vendor/github.com/pquerna/cachecontrol/README.md
@@ -0,0 +1,107 @@
+# cachecontrol: HTTP Caching Parser and Interpretation
+
+[![GoDoc](https://godoc.org/github.com/pquerna/cachecontrol?status.svg)](https://godoc.org/github.com/pquerna/cachecontrol)[![Build Status](https://travis-ci.org/pquerna/cachecontrol.svg?branch=master)](https://travis-ci.org/pquerna/cachecontrol)
+
+ 
+
+`cachecontrol` implements [RFC 7234](http://tools.ietf.org/html/rfc7234) __Hypertext Transfer Protocol (HTTP/1.1): Caching__.  It does this by parsing the `Cache-Control` and other headers, providing information about requests and responses -- but `cachecontrol` does not implement an actual cache backend, just the control plane to make decisions about if a particular response is cachable.
+
+# Usage
+
+`cachecontrol.CachableResponse` returns an array of [reasons](https://godoc.org/github.com/pquerna/cachecontrol/cacheobject#Reason) why a response should not be cached and when it expires.  In the case that `len(reasons) == 0`, the response is cachable according to the RFC.  However, some people want non-compliant caches for various business use cases, so each reason is specifically named, so if your cache wants to cache `POST` requests, it can easily do that, but still be RFC compliant in other situations.
+
+# Examples
+
+## Can you cache Example.com?
+
+```go
+package main
+
+import (
+	"github.com/pquerna/cachecontrol"
+
+	"fmt"
+	"io/ioutil"
+	"net/http"
+)
+
+func main() {
+	req, _ := http.NewRequest("GET", "http://www.example.com/", nil)
+
+	res, _ := http.DefaultClient.Do(req)
+	_, _ = ioutil.ReadAll(res.Body)
+
+	reasons, expires, _ := cachecontrol.CachableResponse(req, res, cachecontrol.Options{})
+
+	fmt.Println("Reasons to not cache: ", reasons)
+	fmt.Println("Expiration: ", expires.String())
+}
+```
+
+## Can I use this in a high performance caching server?
+
+`cachecontrol` is divided into two packages: `cachecontrol` with a high level API, and a lower level `cacheobject` package.  Use [Object](https://godoc.org/github.com/pquerna/cachecontrol/cacheobject#Object) in a high performance use case where you have previously parsed headers containing dates or would like to avoid memory allocations.
+
+```go
+package main
+
+import (
+	"github.com/pquerna/cachecontrol/cacheobject"
+
+	"fmt"
+	"io/ioutil"
+	"net/http"
+)
+
+func main() {
+	req, _ := http.NewRequest("GET", "http://www.example.com/", nil)
+
+	res, _ := http.DefaultClient.Do(req)
+	_, _ = ioutil.ReadAll(res.Body)
+
+	reqDir, _ := cacheobject.ParseRequestCacheControl(req.Header.Get("Cache-Control"))
+
+	resDir, _ := cacheobject.ParseResponseCacheControl(res.Header.Get("Cache-Control"))
+	expiresHeader, _ := http.ParseTime(res.Header.Get("Expires"))
+	dateHeader, _ := http.ParseTime(res.Header.Get("Date"))
+	lastModifiedHeader, _ := http.ParseTime(res.Header.Get("Last-Modified"))
+
+	obj := cacheobject.Object{
+		RespDirectives:         resDir,
+		RespHeaders:            res.Header,
+		RespStatusCode:         res.StatusCode,
+		RespExpiresHeader:      expiresHeader,
+		RespDateHeader:         dateHeader,
+		RespLastModifiedHeader: lastModifiedHeader,
+
+		ReqDirectives: reqDir,
+		ReqHeaders:    req.Header,
+		ReqMethod:     req.Method,
+
+		NowUTC: time.Now().UTC(),
+	}
+	rv := cacheobject.ObjectResults{}
+
+	cacheobject.CachableObject(&obj, &rv)
+	cacheobject.ExpirationObject(&obj, &rv)
+
+	fmt.Println("Errors: ", rv.OutErr)
+	fmt.Println("Reasons to not cache: ", rv.OutReasons)
+	fmt.Println("Warning headers to add: ", rv.OutWarnings)
+	fmt.Println("Expiration: ", rv.OutExpirationTime.String())
+}
+```
+
+## Improvements, bugs, adding features, and taking cachecontrol new directions!
+
+Please [open issues in Github](https://github.com/pquerna/cachecontrol/issues) for ideas, bugs, and general thoughts.  Pull requests are of course preferred :)
+
+# Credits
+
+`cachecontrol` has recieved significant contributions from:
+
+* [Paul Querna](https://github.com/pquerna) 
+
+## License
+
+`cachecontrol` is licensed under the [Apache License, Version 2.0](./LICENSE)
diff --git a/vendor/github.com/pquerna/cachecontrol/api.go b/vendor/github.com/pquerna/cachecontrol/api.go
new file mode 100644
index 0000000..f6f2858
--- /dev/null
+++ b/vendor/github.com/pquerna/cachecontrol/api.go
@@ -0,0 +1,48 @@
+/**
+ *  Copyright 2015 Paul Querna
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package cachecontrol
+
+import (
+	"github.com/pquerna/cachecontrol/cacheobject"
+
+	"net/http"
+	"time"
+)
+
+type Options struct {
+	// Set to True for a prviate cache, which is not shared amoung users (eg, in a browser)
+	// Set to False for a "shared" cache, which is more common in a server context.
+	PrivateCache bool
+}
+
+// Given an HTTP Request, the future Status Code, and an ResponseWriter,
+// determine the possible reasons a response SHOULD NOT be cached.
+func CachableResponseWriter(req *http.Request,
+	statusCode int,
+	resp http.ResponseWriter,
+	opts Options) ([]cacheobject.Reason, time.Time, error) {
+	return cacheobject.UsingRequestResponse(req, statusCode, resp.Header(), opts.PrivateCache)
+}
+
+// Given an HTTP Request and Response, determine the possible reasons a response SHOULD NOT
+// be cached.
+func CachableResponse(req *http.Request,
+	resp *http.Response,
+	opts Options) ([]cacheobject.Reason, time.Time, error) {
+	return cacheobject.UsingRequestResponse(req, resp.StatusCode, resp.Header, opts.PrivateCache)
+}
diff --git a/vendor/github.com/pquerna/cachecontrol/api_test.go b/vendor/github.com/pquerna/cachecontrol/api_test.go
new file mode 100644
index 0000000..208f5f0
--- /dev/null
+++ b/vendor/github.com/pquerna/cachecontrol/api_test.go
@@ -0,0 +1,111 @@
+/**
+ *  Copyright 2015 Paul Querna
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package cachecontrol
+
+import (
+	"github.com/pquerna/cachecontrol/cacheobject"
+	"github.com/stretchr/testify/require"
+
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+)
+
+func roundTrip(t *testing.T, fnc func(w http.ResponseWriter, r *http.Request)) (*http.Request, *http.Response) {
+	ts := httptest.NewServer(http.HandlerFunc(fnc))
+	defer ts.Close()
+
+	req, err := http.NewRequest("GET", ts.URL, nil)
+	require.NoError(t, err)
+
+	res, err := http.DefaultClient.Do(req)
+	require.NoError(t, err)
+
+	_, err = ioutil.ReadAll(res.Body)
+	res.Body.Close()
+	require.NoError(t, err)
+	return req, res
+}
+
+func TestCachableResponsePublic(t *testing.T) {
+	req, res := roundTrip(t, func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.Header().Set("Cache-Control", "public")
+		w.Header().Set("Last-Modified",
+			time.Now().UTC().Add(time.Duration(time.Hour*-5)).Format(http.TimeFormat))
+		fmt.Fprintln(w, `{}`)
+	})
+
+	opts := Options{}
+	reasons, expires, err := CachableResponse(req, res, opts)
+	require.NoError(t, err)
+	require.Len(t, reasons, 0)
+	require.WithinDuration(t,
+		time.Now().UTC().Add(time.Duration(float64(time.Hour)*0.5)),
+		expires,
+		10*time.Second)
+}
+
+func TestCachableResponsePrivate(t *testing.T) {
+	req, res := roundTrip(t, func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.Header().Set("Cache-Control", "private")
+		fmt.Fprintln(w, `{}`)
+	})
+
+	opts := Options{}
+	reasons, expires, err := CachableResponse(req, res, opts)
+	require.NoError(t, err)
+	require.Len(t, reasons, 1)
+	require.Equal(t, reasons[0], cacheobject.ReasonResponsePrivate)
+	require.Equal(t, time.Time{}, expires)
+
+	opts.PrivateCache = true
+	reasons, expires, err = CachableResponse(req, res, opts)
+	require.NoError(t, err)
+	require.Len(t, reasons, 0)
+	require.Equal(t, time.Time{}, expires)
+}
+
+func TestResponseWriter(t *testing.T) {
+	var resp http.ResponseWriter
+	var req *http.Request
+	_, _ = roundTrip(t, func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.Header().Set("Cache-Control", "private")
+		fmt.Fprintln(w, `{}`)
+		resp = w
+		req = r
+	})
+
+	opts := Options{}
+	reasons, expires, err := CachableResponseWriter(req, 200, resp, opts)
+	require.NoError(t, err)
+	require.Len(t, reasons, 1)
+	require.Equal(t, reasons[0], cacheobject.ReasonResponsePrivate)
+	require.Equal(t, time.Time{}, expires)
+
+	opts.PrivateCache = true
+	reasons, expires, err = CachableResponseWriter(req, 200, resp, opts)
+	require.NoError(t, err)
+	require.Len(t, reasons, 0)
+	require.Equal(t, time.Time{}, expires)
+}
diff --git a/vendor/github.com/pquerna/cachecontrol/cacheobject/directive.go b/vendor/github.com/pquerna/cachecontrol/cacheobject/directive.go
new file mode 100644
index 0000000..afa640e
--- /dev/null
+++ b/vendor/github.com/pquerna/cachecontrol/cacheobject/directive.go
@@ -0,0 +1,546 @@
+/**
+ *  Copyright 2015 Paul Querna
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package cacheobject
+
+import (
+	"errors"
+	"math"
+	"net/http"
+	"net/textproto"
+	"strconv"
+	"strings"
+)
+
+// TODO(pquerna): add extensions from here: http://www.iana.org/assignments/http-cache-directives/http-cache-directives.xhtml
+
+var (
+	ErrQuoteMismatch         = errors.New("Missing closing quote")
+	ErrMaxAgeDeltaSeconds    = errors.New("Failed to parse delta-seconds in `max-age`")
+	ErrSMaxAgeDeltaSeconds   = errors.New("Failed to parse delta-seconds in `s-maxage`")
+	ErrMaxStaleDeltaSeconds  = errors.New("Failed to parse delta-seconds in `min-fresh`")
+	ErrMinFreshDeltaSeconds  = errors.New("Failed to parse delta-seconds in `min-fresh`")
+	ErrNoCacheNoArgs         = errors.New("Unexpected argument to `no-cache`")
+	ErrNoStoreNoArgs         = errors.New("Unexpected argument to `no-store`")
+	ErrNoTransformNoArgs     = errors.New("Unexpected argument to `no-transform`")
+	ErrOnlyIfCachedNoArgs    = errors.New("Unexpected argument to `only-if-cached`")
+	ErrMustRevalidateNoArgs  = errors.New("Unexpected argument to `must-revalidate`")
+	ErrPublicNoArgs          = errors.New("Unexpected argument to `public`")
+	ErrProxyRevalidateNoArgs = errors.New("Unexpected argument to `proxy-revalidate`")
+	// Experimental
+	ErrImmutableNoArgs                  = errors.New("Unexpected argument to `immutable`")
+	ErrStaleIfErrorDeltaSeconds         = errors.New("Failed to parse delta-seconds in `stale-if-error`")
+	ErrStaleWhileRevalidateDeltaSeconds = errors.New("Failed to parse delta-seconds in `stale-while-revalidate`")
+)
+
+func whitespace(b byte) bool {
+	if b == '\t' || b == ' ' {
+		return true
+	}
+	return false
+}
+
+func parse(value string, cd cacheDirective) error {
+	var err error = nil
+	i := 0
+
+	for i < len(value) && err == nil {
+		// eat leading whitespace or commas
+		if whitespace(value[i]) || value[i] == ',' {
+			i++
+			continue
+		}
+
+		j := i + 1
+
+		for j < len(value) {
+			if !isToken(value[j]) {
+				break
+			}
+			j++
+		}
+
+		token := strings.ToLower(value[i:j])
+		tokenHasFields := hasFieldNames(token)
+		/*
+			println("GOT TOKEN:")
+			println("	i -> ", i)
+			println("	j -> ", j)
+			println("	token -> ", token)
+		*/
+
+		if j+1 < len(value) && value[j] == '=' {
+			k := j + 1
+			// minimum size two bytes of "", but we let httpUnquote handle it.
+			if k < len(value) && value[k] == '"' {
+				eaten, result := httpUnquote(value[k:])
+				if eaten == -1 {
+					return ErrQuoteMismatch
+				}
+				i = k + eaten
+
+				err = cd.addPair(token, result)
+			} else {
+				z := k
+				for z < len(value) {
+					if tokenHasFields {
+						if whitespace(value[z]) {
+							break
+						}
+					} else {
+						if whitespace(value[z]) || value[z] == ',' {
+							break
+						}
+					}
+					z++
+				}
+				i = z
+
+				result := value[k:z]
+				if result != "" && result[len(result)-1] == ',' {
+					result = result[:len(result)-1]
+				}
+
+				err = cd.addPair(token, result)
+			}
+		} else {
+			if token != "," {
+				err = cd.addToken(token)
+			}
+			i = j
+		}
+	}
+
+	return err
+}
+
+// DeltaSeconds specifies a non-negative integer, representing
+// time in seconds: http://tools.ietf.org/html/rfc7234#section-1.2.1
+//
+// When set to -1, this means unset.
+//
+type DeltaSeconds int32
+
+// Parser for delta-seconds, a uint31, more or less:
+// http://tools.ietf.org/html/rfc7234#section-1.2.1
+func parseDeltaSeconds(v string) (DeltaSeconds, error) {
+	n, err := strconv.ParseUint(v, 10, 32)
+	if err != nil {
+		if numError, ok := err.(*strconv.NumError); ok {
+			if numError.Err == strconv.ErrRange {
+				return DeltaSeconds(math.MaxInt32), nil
+			}
+		}
+		return DeltaSeconds(-1), err
+	} else {
+		if n > math.MaxInt32 {
+			return DeltaSeconds(math.MaxInt32), nil
+		} else {
+			return DeltaSeconds(n), nil
+		}
+	}
+}
+
+// Fields present in a header.
+type FieldNames map[string]bool
+
+// internal interface for shared methods of RequestCacheDirectives and ResponseCacheDirectives
+type cacheDirective interface {
+	addToken(s string) error
+	addPair(s string, v string) error
+}
+
+// LOW LEVEL API: Repersentation of possible request directives in a `Cache-Control` header: http://tools.ietf.org/html/rfc7234#section-5.2.1
+//
+// Note: Many fields will be `nil` in practice.
+//
+type RequestCacheDirectives struct {
+
+	// max-age(delta seconds): http://tools.ietf.org/html/rfc7234#section-5.2.1.1
+	//
+	// The "max-age" request directive indicates that the client is
+	// unwilling to accept a response whose age is greater than the
+	// specified number of seconds.  Unless the max-stale request directive
+	// is also present, the client is not willing to accept a stale
+	// response.
+	MaxAge DeltaSeconds
+
+	// max-stale(delta seconds): http://tools.ietf.org/html/rfc7234#section-5.2.1.2
+	//
+	// The "max-stale" request directive indicates that the client is
+	// willing to accept a response that has exceeded its freshness
+	// lifetime.  If max-stale is assigned a value, then the client is
+	// willing to accept a response that has exceeded its freshness lifetime
+	// by no more than the specified number of seconds.  If no value is
+	// assigned to max-stale, then the client is willing to accept a stale
+	// response of any age.
+	MaxStale DeltaSeconds
+
+	// min-fresh(delta seconds): http://tools.ietf.org/html/rfc7234#section-5.2.1.3
+	//
+	// The "min-fresh" request directive indicates that the client is
+	// willing to accept a response whose freshness lifetime is no less than
+	// its current age plus the specified time in seconds.  That is, the
+	// client wants a response that will still be fresh for at least the
+	// specified number of seconds.
+	MinFresh DeltaSeconds
+
+	// no-cache(bool): http://tools.ietf.org/html/rfc7234#section-5.2.1.4
+	//
+	// The "no-cache" request directive indicates that a cache MUST NOT use
+	// a stored response to satisfy the request without successful
+	// validation on the origin server.
+	NoCache bool
+
+	// no-store(bool): http://tools.ietf.org/html/rfc7234#section-5.2.1.5
+	//
+	// The "no-store" request directive indicates that a cache MUST NOT
+	// store any part of either this request or any response to it.  This
+	// directive applies to both private and shared caches.
+	NoStore bool
+
+	// no-transform(bool): http://tools.ietf.org/html/rfc7234#section-5.2.1.6
+	//
+	// The "no-transform" request directive indicates that an intermediary
+	// (whether or not it implements a cache) MUST NOT transform the
+	// payload, as defined in Section 5.7.2 of RFC7230.
+	NoTransform bool
+
+	// only-if-cached(bool): http://tools.ietf.org/html/rfc7234#section-5.2.1.7
+	//
+	// The "only-if-cached" request directive indicates that the client only
+	// wishes to obtain a stored response.
+	OnlyIfCached bool
+
+	// Extensions: http://tools.ietf.org/html/rfc7234#section-5.2.3
+	//
+	// The Cache-Control header field can be extended through the use of one
+	// or more cache-extension tokens, each with an optional value.  A cache
+	// MUST ignore unrecognized cache directives.
+	Extensions []string
+}
+
+func (cd *RequestCacheDirectives) addToken(token string) error {
+	var err error = nil
+
+	switch token {
+	case "max-age":
+		err = ErrMaxAgeDeltaSeconds
+	case "max-stale":
+		err = ErrMaxStaleDeltaSeconds
+	case "min-fresh":
+		err = ErrMinFreshDeltaSeconds
+	case "no-cache":
+		cd.NoCache = true
+	case "no-store":
+		cd.NoStore = true
+	case "no-transform":
+		cd.NoTransform = true
+	case "only-if-cached":
+		cd.OnlyIfCached = true
+	default:
+		cd.Extensions = append(cd.Extensions, token)
+	}
+	return err
+}
+
+func (cd *RequestCacheDirectives) addPair(token string, v string) error {
+	var err error = nil
+
+	switch token {
+	case "max-age":
+		cd.MaxAge, err = parseDeltaSeconds(v)
+		if err != nil {
+			err = ErrMaxAgeDeltaSeconds
+		}
+	case "max-stale":
+		cd.MaxStale, err = parseDeltaSeconds(v)
+		if err != nil {
+			err = ErrMaxStaleDeltaSeconds
+		}
+	case "min-fresh":
+		cd.MinFresh, err = parseDeltaSeconds(v)
+		if err != nil {
+			err = ErrMinFreshDeltaSeconds
+		}
+	case "no-cache":
+		err = ErrNoCacheNoArgs
+	case "no-store":
+		err = ErrNoStoreNoArgs
+	case "no-transform":
+		err = ErrNoTransformNoArgs
+	case "only-if-cached":
+		err = ErrOnlyIfCachedNoArgs
+	default:
+		// TODO(pquerna): this sucks, making user re-parse
+		cd.Extensions = append(cd.Extensions, token+"="+v)
+	}
+
+	return err
+}
+
+// LOW LEVEL API: Parses a Cache Control Header from a Request into a set of directives.
+func ParseRequestCacheControl(value string) (*RequestCacheDirectives, error) {
+	cd := &RequestCacheDirectives{
+		MaxAge:   -1,
+		MaxStale: -1,
+		MinFresh: -1,
+	}
+
+	err := parse(value, cd)
+	if err != nil {
+		return nil, err
+	}
+	return cd, nil
+}
+
+// LOW LEVEL API: Repersentation of possible response directives in a `Cache-Control` header: http://tools.ietf.org/html/rfc7234#section-5.2.2
+//
+// Note: Many fields will be `nil` in practice.
+//
+type ResponseCacheDirectives struct {
+
+	// must-revalidate(bool): http://tools.ietf.org/html/rfc7234#section-5.2.2.1
+	//
+	// The "must-revalidate" response directive indicates that once it has
+	// become stale, a cache MUST NOT use the response to satisfy subsequent
+	// requests without successful validation on the origin server.
+	MustRevalidate bool
+
+	// no-cache(FieldName): http://tools.ietf.org/html/rfc7234#section-5.2.2.2
+	//
+	// The "no-cache" response directive indicates that the response MUST
+	// NOT be used to satisfy a subsequent request without successful
+	// validation on the origin server.
+	//
+	// If the no-cache response directive specifies one or more field-names,
+	// then a cache MAY use the response to satisfy a subsequent request,
+	// subject to any other restrictions on caching.  However, any header
+	// fields in the response that have the field-name(s) listed MUST NOT be
+	// sent in the response to a subsequent request without successful
+	// revalidation with the origin server.
+	NoCache FieldNames
+
+	// no-cache(cast-to-bool): http://tools.ietf.org/html/rfc7234#section-5.2.2.2
+	//
+	// While the RFC defines optional field-names on a no-cache directive,
+	// many applications only want to know if any no-cache directives were
+	// present at all.
+	NoCachePresent bool
+
+	// no-store(bool): http://tools.ietf.org/html/rfc7234#section-5.2.2.3
+	//
+	// The "no-store" request directive indicates that a cache MUST NOT
+	// store any part of either this request or any response to it.  This
+	// directive applies to both private and shared caches.
+	NoStore bool
+
+	// no-transform(bool): http://tools.ietf.org/html/rfc7234#section-5.2.2.4
+	//
+	// The "no-transform" response directive indicates that an intermediary
+	// (regardless of whether it implements a cache) MUST NOT transform the
+	// payload, as defined in Section 5.7.2 of RFC7230.
+	NoTransform bool
+
+	// public(bool): http://tools.ietf.org/html/rfc7234#section-5.2.2.5
+	//
+	// The "public" response directive indicates that any cache MAY store
+	// the response, even if the response would normally be non-cacheable or
+	// cacheable only within a private cache.
+	Public bool
+
+	// private(FieldName): http://tools.ietf.org/html/rfc7234#section-5.2.2.6
+	//
+	// The "private" response directive indicates that the response message
+	// is intended for a single user and MUST NOT be stored by a shared
+	// cache.  A private cache MAY store the response and reuse it for later
+	// requests, even if the response would normally be non-cacheable.
+	//
+	// If the private response directive specifies one or more field-names,
+	// this requirement is limited to the field-values associated with the
+	// listed response header fields.  That is, a shared cache MUST NOT
+	// store the specified field-names(s), whereas it MAY store the
+	// remainder of the response message.
+	Private FieldNames
+
+	// private(cast-to-bool): http://tools.ietf.org/html/rfc7234#section-5.2.2.6
+	//
+	// While the RFC defines optional field-names on a private directive,
+	// many applications only want to know if any private directives were
+	// present at all.
+	PrivatePresent bool
+
+	// proxy-revalidate(bool): http://tools.ietf.org/html/rfc7234#section-5.2.2.7
+	//
+	// The "proxy-revalidate" response directive has the same meaning as the
+	// must-revalidate response directive, except that it does not apply to
+	// private caches.
+	ProxyRevalidate bool
+
+	// max-age(delta seconds): http://tools.ietf.org/html/rfc7234#section-5.2.2.8
+	//
+	// The "max-age" response directive indicates that the response is to be
+	// considered stale after its age is greater than the specified number
+	// of seconds.
+	MaxAge DeltaSeconds
+
+	// s-maxage(delta seconds): http://tools.ietf.org/html/rfc7234#section-5.2.2.9
+	//
+	// The "s-maxage" response directive indicates that, in shared caches,
+	// the maximum age specified by this directive overrides the maximum age
+	// specified by either the max-age directive or the Expires header
+	// field.  The s-maxage directive also implies the semantics of the
+	// proxy-revalidate response directive.
+	SMaxAge DeltaSeconds
+
+	////
+	// Experimental features
+	// - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control#Extension_Cache-Control_directives
+	// - https://www.fastly.com/blog/stale-while-revalidate-stale-if-error-available-today
+	////
+
+	// immutable(cast-to-bool): experimental feature
+	Immutable bool
+
+	// stale-if-error(delta seconds): experimental feature
+	StaleIfError DeltaSeconds
+
+	// stale-while-revalidate(delta seconds): experimental feature
+	StaleWhileRevalidate DeltaSeconds
+
+	// Extensions: http://tools.ietf.org/html/rfc7234#section-5.2.3
+	//
+	// The Cache-Control header field can be extended through the use of one
+	// or more cache-extension tokens, each with an optional value.  A cache
+	// MUST ignore unrecognized cache directives.
+	Extensions []string
+}
+
+// LOW LEVEL API: Parses a Cache Control Header from a Response into a set of directives.
+func ParseResponseCacheControl(value string) (*ResponseCacheDirectives, error) {
+	cd := &ResponseCacheDirectives{
+		MaxAge:  -1,
+		SMaxAge: -1,
+		// Exerimantal stale timeouts
+		StaleIfError:         -1,
+		StaleWhileRevalidate: -1,
+	}
+
+	err := parse(value, cd)
+	if err != nil {
+		return nil, err
+	}
+	return cd, nil
+}
+
+func (cd *ResponseCacheDirectives) addToken(token string) error {
+	var err error = nil
+	switch token {
+	case "must-revalidate":
+		cd.MustRevalidate = true
+	case "no-cache":
+		cd.NoCachePresent = true
+	case "no-store":
+		cd.NoStore = true
+	case "no-transform":
+		cd.NoTransform = true
+	case "public":
+		cd.Public = true
+	case "private":
+		cd.PrivatePresent = true
+	case "proxy-revalidate":
+		cd.ProxyRevalidate = true
+	case "max-age":
+		err = ErrMaxAgeDeltaSeconds
+	case "s-maxage":
+		err = ErrSMaxAgeDeltaSeconds
+	// Experimental
+	case "immutable":
+		cd.Immutable = true
+	case "stale-if-error":
+		err = ErrMaxAgeDeltaSeconds
+	case "stale-while-revalidate":
+		err = ErrMaxAgeDeltaSeconds
+	default:
+		cd.Extensions = append(cd.Extensions, token)
+	}
+	return err
+}
+
+func hasFieldNames(token string) bool {
+	switch token {
+	case "no-cache":
+		return true
+	case "private":
+		return true
+	}
+	return false
+}
+
+func (cd *ResponseCacheDirectives) addPair(token string, v string) error {
+	var err error = nil
+
+	switch token {
+	case "must-revalidate":
+		err = ErrMustRevalidateNoArgs
+	case "no-cache":
+		cd.NoCachePresent = true
+		tokens := strings.Split(v, ",")
+		if cd.NoCache == nil {
+			cd.NoCache = make(FieldNames)
+		}
+		for _, t := range tokens {
+			k := http.CanonicalHeaderKey(textproto.TrimString(t))
+			cd.NoCache[k] = true
+		}
+	case "no-store":
+		err = ErrNoStoreNoArgs
+	case "no-transform":
+		err = ErrNoTransformNoArgs
+	case "public":
+		err = ErrPublicNoArgs
+	case "private":
+		cd.PrivatePresent = true
+		tokens := strings.Split(v, ",")
+		if cd.Private == nil {
+			cd.Private = make(FieldNames)
+		}
+		for _, t := range tokens {
+			k := http.CanonicalHeaderKey(textproto.TrimString(t))
+			cd.Private[k] = true
+		}
+	case "proxy-revalidate":
+		err = ErrProxyRevalidateNoArgs
+	case "max-age":
+		cd.MaxAge, err = parseDeltaSeconds(v)
+	case "s-maxage":
+		cd.SMaxAge, err = parseDeltaSeconds(v)
+	// Experimental
+	case "immutable":
+		err = ErrImmutableNoArgs
+	case "stale-if-error":
+		cd.StaleIfError, err = parseDeltaSeconds(v)
+	case "stale-while-revalidate":
+		cd.StaleWhileRevalidate, err = parseDeltaSeconds(v)
+	default:
+		// TODO(pquerna): this sucks, making user re-parse, and its technically not 'quoted' like the original,
+		// but this is still easier, just a SplitN on "="
+		cd.Extensions = append(cd.Extensions, token+"="+v)
+	}
+
+	return err
+}
diff --git a/vendor/github.com/pquerna/cachecontrol/cacheobject/directive_test.go b/vendor/github.com/pquerna/cachecontrol/cacheobject/directive_test.go
new file mode 100644
index 0000000..f420fec
--- /dev/null
+++ b/vendor/github.com/pquerna/cachecontrol/cacheobject/directive_test.go
@@ -0,0 +1,454 @@
+/**
+ *  Copyright 2015 Paul Querna
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package cacheobject
+
+import (
+	"github.com/stretchr/testify/require"
+
+	"fmt"
+	"math"
+	"testing"
+)
+
+func TestMaxAge(t *testing.T) {
+	cd, err := ParseResponseCacheControl("")
+	require.NoError(t, err)
+	require.Equal(t, cd.MaxAge, DeltaSeconds(-1))
+
+	cd, err = ParseResponseCacheControl("max-age")
+	require.Error(t, err)
+
+	cd, err = ParseResponseCacheControl("max-age=20")
+	require.NoError(t, err)
+	require.Equal(t, cd.MaxAge, DeltaSeconds(20))
+
+	cd, err = ParseResponseCacheControl("max-age=0")
+	require.NoError(t, err)
+	require.Equal(t, cd.MaxAge, DeltaSeconds(0))
+
+	cd, err = ParseResponseCacheControl("max-age=-1")
+	require.Error(t, err)
+}
+
+func TestSMaxAge(t *testing.T) {
+	cd, err := ParseResponseCacheControl("")
+	require.NoError(t, err)
+	require.Equal(t, cd.SMaxAge, DeltaSeconds(-1))
+
+	cd, err = ParseResponseCacheControl("s-maxage")
+	require.Error(t, err)
+
+	cd, err = ParseResponseCacheControl("s-maxage=20")
+	require.NoError(t, err)
+	require.Equal(t, cd.SMaxAge, DeltaSeconds(20))
+
+	cd, err = ParseResponseCacheControl("s-maxage=0")
+	require.NoError(t, err)
+	require.Equal(t, cd.SMaxAge, DeltaSeconds(0))
+
+	cd, err = ParseResponseCacheControl("s-maxage=-1")
+	require.Error(t, err)
+}
+
+func TestResNoCache(t *testing.T) {
+	cd, err := ParseResponseCacheControl("")
+	require.NoError(t, err)
+	require.Equal(t, cd.SMaxAge, DeltaSeconds(-1))
+
+	cd, err = ParseResponseCacheControl("no-cache")
+	require.NoError(t, err)
+	require.Equal(t, cd.NoCachePresent, true)
+	require.Equal(t, len(cd.NoCache), 0)
+
+	cd, err = ParseResponseCacheControl("no-cache=MyThing")
+	require.NoError(t, err)
+	require.Equal(t, cd.NoCachePresent, true)
+	require.Equal(t, len(cd.NoCache), 1)
+}
+
+func TestResSpaceOnly(t *testing.T) {
+	cd, err := ParseResponseCacheControl(" ")
+	require.NoError(t, err)
+	require.Equal(t, cd.SMaxAge, DeltaSeconds(-1))
+}
+
+func TestResTabOnly(t *testing.T) {
+	cd, err := ParseResponseCacheControl("\t")
+	require.NoError(t, err)
+	require.Equal(t, cd.SMaxAge, DeltaSeconds(-1))
+}
+
+func TestResPrivateExtensionQuoted(t *testing.T) {
+	cd, err := ParseResponseCacheControl(`private="Set-Cookie,Request-Id" public`)
+	require.NoError(t, err)
+	require.Equal(t, cd.Public, true)
+	require.Equal(t, cd.PrivatePresent, true)
+	require.Equal(t, len(cd.Private), 2)
+	require.Equal(t, len(cd.Extensions), 0)
+	require.Equal(t, cd.Private["Set-Cookie"], true)
+	require.Equal(t, cd.Private["Request-Id"], true)
+}
+
+func TestResCommaFollowingBare(t *testing.T) {
+	cd, err := ParseResponseCacheControl(`public, max-age=500`)
+	require.NoError(t, err)
+	require.Equal(t, cd.Public, true)
+	require.Equal(t, cd.MaxAge, DeltaSeconds(500))
+	require.Equal(t, cd.PrivatePresent, false)
+	require.Equal(t, len(cd.Extensions), 0)
+}
+
+func TestResCommaFollowingKV(t *testing.T) {
+	cd, err := ParseResponseCacheControl(`max-age=500, public`)
+	require.NoError(t, err)
+	require.Equal(t, cd.Public, true)
+	require.Equal(t, cd.MaxAge, DeltaSeconds(500))
+	require.Equal(t, cd.PrivatePresent, false)
+	require.Equal(t, len(cd.Extensions), 0)
+}
+
+func TestResPrivateTrailingComma(t *testing.T) {
+	cd, err := ParseResponseCacheControl(`private=Set-Cookie, public`)
+	require.NoError(t, err)
+	require.Equal(t, cd.Public, true)
+	require.Equal(t, cd.PrivatePresent, true)
+	require.Equal(t, len(cd.Private), 1)
+	require.Equal(t, len(cd.Extensions), 0)
+	require.Equal(t, cd.Private["Set-Cookie"], true)
+}
+
+func TestResPrivateExtension(t *testing.T) {
+	cd, err := ParseResponseCacheControl(`private=Set-Cookie,Request-Id public`)
+	require.NoError(t, err)
+	require.Equal(t, cd.Public, true)
+	require.Equal(t, cd.PrivatePresent, true)
+	require.Equal(t, len(cd.Private), 2)
+	require.Equal(t, len(cd.Extensions), 0)
+	require.Equal(t, cd.Private["Set-Cookie"], true)
+	require.Equal(t, cd.Private["Request-Id"], true)
+}
+
+func TestResMultipleNoCacheTabExtension(t *testing.T) {
+	cd, err := ParseResponseCacheControl("no-cache " + "\t" + "no-cache=Mything aasdfdsfa")
+	require.NoError(t, err)
+	require.Equal(t, cd.NoCachePresent, true)
+	require.Equal(t, len(cd.NoCache), 1)
+	require.Equal(t, len(cd.Extensions), 1)
+	require.Equal(t, cd.NoCache["Mything"], true)
+}
+
+func TestResExtensionsEmptyQuote(t *testing.T) {
+	cd, err := ParseResponseCacheControl(`foo="" bar="hi"`)
+	require.NoError(t, err)
+	require.Equal(t, cd.SMaxAge, DeltaSeconds(-1))
+	require.Equal(t, len(cd.Extensions), 2)
+	require.Contains(t, cd.Extensions, "bar=hi")
+	require.Contains(t, cd.Extensions, "foo=")
+}
+
+func TestResQuoteMismatch(t *testing.T) {
+	cd, err := ParseResponseCacheControl(`foo="`)
+	require.Error(t, err)
+	require.Nil(t, cd)
+	require.Equal(t, err, ErrQuoteMismatch)
+}
+
+func TestResMustRevalidateNoArgs(t *testing.T) {
+	cd, err := ParseResponseCacheControl(`must-revalidate=234`)
+	require.Error(t, err)
+	require.Nil(t, cd)
+	require.Equal(t, err, ErrMustRevalidateNoArgs)
+}
+
+func TestResNoTransformNoArgs(t *testing.T) {
+	cd, err := ParseResponseCacheControl(`no-transform="xxx"`)
+	require.Error(t, err)
+	require.Nil(t, cd)
+	require.Equal(t, err, ErrNoTransformNoArgs)
+}
+
+func TestResNoStoreNoArgs(t *testing.T) {
+	cd, err := ParseResponseCacheControl(`no-store=""`)
+	require.Error(t, err)
+	require.Nil(t, cd)
+	require.Equal(t, err, ErrNoStoreNoArgs)
+}
+
+func TestResProxyRevalidateNoArgs(t *testing.T) {
+	cd, err := ParseResponseCacheControl(`proxy-revalidate=23432`)
+	require.Error(t, err)
+	require.Nil(t, cd)
+	require.Equal(t, err, ErrProxyRevalidateNoArgs)
+}
+
+func TestResPublicNoArgs(t *testing.T) {
+	cd, err := ParseResponseCacheControl(`public=999Vary`)
+	require.Error(t, err)
+	require.Nil(t, cd)
+	require.Equal(t, err, ErrPublicNoArgs)
+}
+
+func TestResMustRevalidate(t *testing.T) {
+	cd, err := ParseResponseCacheControl(`must-revalidate`)
+	require.NoError(t, err)
+	require.NotNil(t, cd)
+	require.Equal(t, cd.MustRevalidate, true)
+}
+
+func TestResNoTransform(t *testing.T) {
+	cd, err := ParseResponseCacheControl(`no-transform`)
+	require.NoError(t, err)
+	require.NotNil(t, cd)
+	require.Equal(t, cd.NoTransform, true)
+}
+
+func TestResNoStore(t *testing.T) {
+	cd, err := ParseResponseCacheControl(`no-store`)
+	require.NoError(t, err)
+	require.NotNil(t, cd)
+	require.Equal(t, cd.NoStore, true)
+}
+
+func TestResProxyRevalidate(t *testing.T) {
+	cd, err := ParseResponseCacheControl(`proxy-revalidate`)
+	require.NoError(t, err)
+	require.NotNil(t, cd)
+	require.Equal(t, cd.ProxyRevalidate, true)
+}
+
+func TestResPublic(t *testing.T) {
+	cd, err := ParseResponseCacheControl(`public`)
+	require.NoError(t, err)
+	require.NotNil(t, cd)
+	require.Equal(t, cd.Public, true)
+}
+
+func TestResPrivate(t *testing.T) {
+	cd, err := ParseResponseCacheControl(`private`)
+	require.NoError(t, err)
+	require.NotNil(t, cd)
+	require.Len(t, cd.Private, 0)
+	require.Equal(t, cd.PrivatePresent, true)
+}
+
+func TestResImmutable(t *testing.T) {
+	cd, err := ParseResponseCacheControl(`immutable`)
+	require.NoError(t, err)
+	require.NotNil(t, cd)
+	require.Equal(t, cd.Immutable, true)
+}
+
+func TestResStaleIfError(t *testing.T) {
+	cd, err := ParseResponseCacheControl(`stale-if-error=99999`)
+	require.NoError(t, err)
+	require.NotNil(t, cd)
+	require.Equal(t, cd.StaleIfError, DeltaSeconds(99999))
+}
+
+func TestResStaleWhileRevalidate(t *testing.T) {
+	cd, err := ParseResponseCacheControl(`stale-while-revalidate=99999`)
+	require.NoError(t, err)
+	require.NotNil(t, cd)
+	require.Equal(t, cd.StaleWhileRevalidate, DeltaSeconds(99999))
+}
+
+func TestParseDeltaSecondsZero(t *testing.T) {
+	ds, err := parseDeltaSeconds("0")
+	require.NoError(t, err)
+	require.Equal(t, ds, DeltaSeconds(0))
+}
+
+func TestParseDeltaSecondsLarge(t *testing.T) {
+	ds, err := parseDeltaSeconds(fmt.Sprintf("%d", int64(math.MaxInt32)*2))
+	require.NoError(t, err)
+	require.Equal(t, ds, DeltaSeconds(math.MaxInt32))
+}
+
+func TestParseDeltaSecondsVeryLarge(t *testing.T) {
+	ds, err := parseDeltaSeconds(fmt.Sprintf("%d", int64(math.MaxInt64)))
+	require.NoError(t, err)
+	require.Equal(t, ds, DeltaSeconds(math.MaxInt32))
+}
+
+func TestParseDeltaSecondsNegative(t *testing.T) {
+	ds, err := parseDeltaSeconds("-60")
+	require.Error(t, err)
+	require.Equal(t, DeltaSeconds(-1), ds)
+}
+
+func TestReqNoCacheNoArgs(t *testing.T) {
+	cd, err := ParseRequestCacheControl(`no-cache=234`)
+	require.Error(t, err)
+	require.Nil(t, cd)
+	require.Equal(t, err, ErrNoCacheNoArgs)
+}
+
+func TestReqNoStoreNoArgs(t *testing.T) {
+	cd, err := ParseRequestCacheControl(`no-store=,,x`)
+	require.Error(t, err)
+	require.Nil(t, cd)
+	require.Equal(t, err, ErrNoStoreNoArgs)
+}
+
+func TestReqNoTransformNoArgs(t *testing.T) {
+	cd, err := ParseRequestCacheControl(`no-transform=akx`)
+	require.Error(t, err)
+	require.Nil(t, cd)
+	require.Equal(t, err, ErrNoTransformNoArgs)
+}
+
+func TestReqOnlyIfCachedNoArgs(t *testing.T) {
+	cd, err := ParseRequestCacheControl(`only-if-cached=no-store`)
+	require.Error(t, err)
+	require.Nil(t, cd)
+	require.Equal(t, err, ErrOnlyIfCachedNoArgs)
+}
+
+func TestReqMaxAge(t *testing.T) {
+	cd, err := ParseRequestCacheControl(`max-age=99999`)
+	require.NoError(t, err)
+	require.NotNil(t, cd)
+	require.Equal(t, cd.MaxAge, DeltaSeconds(99999))
+	require.Equal(t, cd.MaxStale, DeltaSeconds(-1))
+}
+
+func TestReqMaxStale(t *testing.T) {
+	cd, err := ParseRequestCacheControl(`max-stale=99999`)
+	require.NoError(t, err)
+	require.NotNil(t, cd)
+	require.Equal(t, cd.MaxStale, DeltaSeconds(99999))
+	require.Equal(t, cd.MaxAge, DeltaSeconds(-1))
+	require.Equal(t, cd.MinFresh, DeltaSeconds(-1))
+}
+
+func TestReqMaxAgeBroken(t *testing.T) {
+	cd, err := ParseRequestCacheControl(`max-age`)
+	require.Error(t, err)
+	require.Equal(t, ErrMaxAgeDeltaSeconds, err)
+	require.Nil(t, cd)
+}
+
+func TestReqMaxStaleBroken(t *testing.T) {
+	cd, err := ParseRequestCacheControl(`max-stale`)
+	require.Error(t, err)
+	require.Equal(t, ErrMaxStaleDeltaSeconds, err)
+	require.Nil(t, cd)
+}
+
+func TestReqMinFresh(t *testing.T) {
+	cd, err := ParseRequestCacheControl(`min-fresh=99999`)
+	require.NoError(t, err)
+	require.NotNil(t, cd)
+	require.Equal(t, cd.MinFresh, DeltaSeconds(99999))
+	require.Equal(t, cd.MaxAge, DeltaSeconds(-1))
+	require.Equal(t, cd.MaxStale, DeltaSeconds(-1))
+}
+
+func TestReqMinFreshBroken(t *testing.T) {
+	cd, err := ParseRequestCacheControl(`min-fresh`)
+	require.Error(t, err)
+	require.Equal(t, ErrMinFreshDeltaSeconds, err)
+	require.Nil(t, cd)
+}
+
+func TestReqMinFreshJunk(t *testing.T) {
+	cd, err := ParseRequestCacheControl(`min-fresh=a99a`)
+	require.Equal(t, ErrMinFreshDeltaSeconds, err)
+	require.Nil(t, cd)
+}
+
+func TestReqMinFreshBadValue(t *testing.T) {
+	cd, err := ParseRequestCacheControl(`min-fresh=-1`)
+	require.Equal(t, ErrMinFreshDeltaSeconds, err)
+	require.Nil(t, cd)
+}
+
+func TestReqExtensions(t *testing.T) {
+	cd, err := ParseRequestCacheControl(`min-fresh=99999 foobar=1 cats`)
+	require.NoError(t, err)
+	require.NotNil(t, cd)
+	require.Equal(t, cd.MinFresh, DeltaSeconds(99999))
+	require.Equal(t, cd.MaxAge, DeltaSeconds(-1))
+	require.Equal(t, cd.MaxStale, DeltaSeconds(-1))
+	require.Len(t, cd.Extensions, 2)
+	require.Contains(t, cd.Extensions, "foobar=1")
+	require.Contains(t, cd.Extensions, "cats")
+}
+
+func TestReqMultiple(t *testing.T) {
+	cd, err := ParseRequestCacheControl(`no-store no-transform`)
+	require.NoError(t, err)
+	require.NotNil(t, cd)
+	require.Equal(t, cd.NoStore, true)
+	require.Equal(t, cd.NoTransform, true)
+	require.Equal(t, cd.OnlyIfCached, false)
+	require.Len(t, cd.Extensions, 0)
+}
+
+func TestReqMultipleComma(t *testing.T) {
+	cd, err := ParseRequestCacheControl(`no-cache,only-if-cached`)
+	require.NoError(t, err)
+	require.NotNil(t, cd)
+	require.Equal(t, cd.NoCache, true)
+	require.Equal(t, cd.NoStore, false)
+	require.Equal(t, cd.NoTransform, false)
+	require.Equal(t, cd.OnlyIfCached, true)
+	require.Len(t, cd.Extensions, 0)
+}
+
+func TestReqLeadingComma(t *testing.T) {
+	cd, err := ParseRequestCacheControl(`,no-cache`)
+	require.NoError(t, err)
+	require.NotNil(t, cd)
+	require.Len(t, cd.Extensions, 0)
+	require.Equal(t, cd.NoCache, true)
+	require.Equal(t, cd.NoStore, false)
+	require.Equal(t, cd.NoTransform, false)
+	require.Equal(t, cd.OnlyIfCached, false)
+}
+
+func TestReqMinFreshQuoted(t *testing.T) {
+	cd, err := ParseRequestCacheControl(`min-fresh="99999"`)
+	require.NoError(t, err)
+	require.NotNil(t, cd)
+	require.Equal(t, cd.MinFresh, DeltaSeconds(99999))
+	require.Equal(t, cd.MaxAge, DeltaSeconds(-1))
+	require.Equal(t, cd.MaxStale, DeltaSeconds(-1))
+}
+
+func TestNoSpacesIssue3(t *testing.T) {
+	cd, err := ParseResponseCacheControl(`no-cache,no-store,max-age=0,must-revalidate`)
+	require.NoError(t, err)
+	require.NotNil(t, cd)
+	require.Equal(t, cd.NoCachePresent, true)
+	require.Equal(t, cd.NoStore, true)
+	require.Equal(t, cd.MaxAge, DeltaSeconds(0))
+	require.Equal(t, cd.MustRevalidate, true)
+}
+
+func TestNoSpacesIssue3PrivateFields(t *testing.T) {
+	cd, err := ParseResponseCacheControl(`no-cache, no-store, private=set-cookie,hello, max-age=0, must-revalidate`)
+	require.NoError(t, err)
+	require.NotNil(t, cd)
+	require.Equal(t, cd.NoCachePresent, true)
+	require.Equal(t, cd.NoStore, true)
+	require.Equal(t, cd.MaxAge, DeltaSeconds(0))
+	require.Equal(t, cd.MustRevalidate, true)
+	require.Equal(t, true, cd.Private["Set-Cookie"])
+	require.Equal(t, true, cd.Private["Hello"])
+}
diff --git a/vendor/github.com/pquerna/cachecontrol/cacheobject/lex.go b/vendor/github.com/pquerna/cachecontrol/cacheobject/lex.go
new file mode 100644
index 0000000..c658e09
--- /dev/null
+++ b/vendor/github.com/pquerna/cachecontrol/cacheobject/lex.go
@@ -0,0 +1,93 @@
+// Copyright 2009 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package cacheobject
+
+// This file deals with lexical matters of HTTP
+
+func isSeparator(c byte) bool {
+	switch c {
+	case '(', ')', '<', '>', '@', ',', ';', ':', '\\', '"', '/', '[', ']', '?', '=', '{', '}', ' ', '\t':
+		return true
+	}
+	return false
+}
+
+func isCtl(c byte) bool { return (0 <= c && c <= 31) || c == 127 }
+
+func isChar(c byte) bool { return 0 <= c && c <= 127 }
+
+func isAnyText(c byte) bool { return !isCtl(c) }
+
+func isQdText(c byte) bool { return isAnyText(c) && c != '"' }
+
+func isToken(c byte) bool { return isChar(c) && !isCtl(c) && !isSeparator(c) }
+
+// Valid escaped sequences are not specified in RFC 2616, so for now, we assume
+// that they coincide with the common sense ones used by GO. Malformed
+// characters should probably not be treated as errors by a robust (forgiving)
+// parser, so we replace them with the '?' character.
+func httpUnquotePair(b byte) byte {
+	// skip the first byte, which should always be '\'
+	switch b {
+	case 'a':
+		return '\a'
+	case 'b':
+		return '\b'
+	case 'f':
+		return '\f'
+	case 'n':
+		return '\n'
+	case 'r':
+		return '\r'
+	case 't':
+		return '\t'
+	case 'v':
+		return '\v'
+	case '\\':
+		return '\\'
+	case '\'':
+		return '\''
+	case '"':
+		return '"'
+	}
+	return '?'
+}
+
+// raw must begin with a valid quoted string. Only the first quoted string is
+// parsed and is unquoted in result. eaten is the number of bytes parsed, or -1
+// upon failure.
+func httpUnquote(raw string) (eaten int, result string) {
+	buf := make([]byte, len(raw))
+	if raw[0] != '"' {
+		return -1, ""
+	}
+	eaten = 1
+	j := 0 // # of bytes written in buf
+	for i := 1; i < len(raw); i++ {
+		switch b := raw[i]; b {
+		case '"':
+			eaten++
+			buf = buf[0:j]
+			return i + 1, string(buf)
+		case '\\':
+			if len(raw) < i+2 {
+				return -1, ""
+			}
+			buf[j] = httpUnquotePair(raw[i+1])
+			eaten += 2
+			j++
+			i++
+		default:
+			if isQdText(b) {
+				buf[j] = b
+			} else {
+				buf[j] = '?'
+			}
+			eaten++
+			j++
+		}
+	}
+	return -1, ""
+}
diff --git a/vendor/github.com/pquerna/cachecontrol/cacheobject/object.go b/vendor/github.com/pquerna/cachecontrol/cacheobject/object.go
new file mode 100644
index 0000000..c20a1d6
--- /dev/null
+++ b/vendor/github.com/pquerna/cachecontrol/cacheobject/object.go
@@ -0,0 +1,387 @@
+/**
+ *  Copyright 2015 Paul Querna
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package cacheobject
+
+import (
+	"net/http"
+	"time"
+)
+
+// LOW LEVEL API: Repersents a potentially cachable HTTP object.
+//
+// This struct is designed to be serialized efficiently, so in a high
+// performance caching server, things like Date-Strings don't need to be
+// parsed for every use of a cached object.
+type Object struct {
+	CacheIsPrivate bool
+
+	RespDirectives         *ResponseCacheDirectives
+	RespHeaders            http.Header
+	RespStatusCode         int
+	RespExpiresHeader      time.Time
+	RespDateHeader         time.Time
+	RespLastModifiedHeader time.Time
+
+	ReqDirectives *RequestCacheDirectives
+	ReqHeaders    http.Header
+	ReqMethod     string
+
+	NowUTC time.Time
+}
+
+// LOW LEVEL API: Repersents the results of examinig an Object with
+// CachableObject and ExpirationObject.
+//
+// TODO(pquerna): decide if this is a good idea or bad
+type ObjectResults struct {
+	OutReasons        []Reason
+	OutWarnings       []Warning
+	OutExpirationTime time.Time
+	OutErr            error
+}
+
+// LOW LEVEL API: Check if a object is cachable.
+func CachableObject(obj *Object, rv *ObjectResults) {
+	rv.OutReasons = nil
+	rv.OutWarnings = nil
+	rv.OutErr = nil
+
+	switch obj.ReqMethod {
+	case "GET":
+		break
+	case "HEAD":
+		break
+	case "POST":
+		/**
+		  POST: http://tools.ietf.org/html/rfc7231#section-4.3.3
+
+		  Responses to POST requests are only cacheable when they include
+		  explicit freshness information (see Section 4.2.1 of [RFC7234]).
+		  However, POST caching is not widely implemented.  For cases where an
+		  origin server wishes the client to be able to cache the result of a
+		  POST in a way that can be reused by a later GET, the origin server
+		  MAY send a 200 (OK) response containing the result and a
+		  Content-Location header field that has the same value as the POST's
+		  effective request URI (Section 3.1.4.2).
+		*/
+		if !hasFreshness(obj.ReqDirectives, obj.RespDirectives, obj.RespHeaders, obj.RespExpiresHeader, obj.CacheIsPrivate) {
+			rv.OutReasons = append(rv.OutReasons, ReasonRequestMethodPOST)
+		}
+
+	case "PUT":
+		rv.OutReasons = append(rv.OutReasons, ReasonRequestMethodPUT)
+
+	case "DELETE":
+		rv.OutReasons = append(rv.OutReasons, ReasonRequestMethodDELETE)
+
+	case "CONNECT":
+		rv.OutReasons = append(rv.OutReasons, ReasonRequestMethodCONNECT)
+
+	case "OPTIONS":
+		rv.OutReasons = append(rv.OutReasons, ReasonRequestMethodOPTIONS)
+
+	case "TRACE":
+		rv.OutReasons = append(rv.OutReasons, ReasonRequestMethodTRACE)
+
+	// HTTP Extension Methods: http://www.iana.org/assignments/http-methods/http-methods.xhtml
+	//
+	// To my knowledge, none of them are cachable. Please open a ticket if this is not the case!
+	//
+	default:
+		rv.OutReasons = append(rv.OutReasons, ReasonRequestMethodUnkown)
+	}
+
+	if obj.ReqDirectives.NoStore {
+		rv.OutReasons = append(rv.OutReasons, ReasonRequestNoStore)
+	}
+
+	// Storing Responses to Authenticated Requests: http://tools.ietf.org/html/rfc7234#section-3.2
+	authz := obj.ReqHeaders.Get("Authorization")
+	if authz != "" {
+		if obj.RespDirectives.MustRevalidate ||
+			obj.RespDirectives.Public ||
+			obj.RespDirectives.SMaxAge != -1 {
+			// Expires of some kind present, this is potentially OK.
+		} else {
+			rv.OutReasons = append(rv.OutReasons, ReasonRequestAuthorizationHeader)
+		}
+	}
+
+	if obj.RespDirectives.PrivatePresent && !obj.CacheIsPrivate {
+		rv.OutReasons = append(rv.OutReasons, ReasonResponsePrivate)
+	}
+
+	if obj.RespDirectives.NoStore {
+		rv.OutReasons = append(rv.OutReasons, ReasonResponseNoStore)
+	}
+
+	/*
+	   the response either:
+
+	     *  contains an Expires header field (see Section 5.3), or
+
+	     *  contains a max-age response directive (see Section 5.2.2.8), or
+
+	     *  contains a s-maxage response directive (see Section 5.2.2.9)
+	        and the cache is shared, or
+
+	     *  contains a Cache Control Extension (see Section 5.2.3) that
+	        allows it to be cached, or
+
+	     *  has a status code that is defined as cacheable by default (see
+	        Section 4.2.2), or
+
+	     *  contains a public response directive (see Section 5.2.2.5).
+	*/
+
+	expires := obj.RespHeaders.Get("Expires") != ""
+	statusCachable := cachableStatusCode(obj.RespStatusCode)
+
+	if expires ||
+		obj.RespDirectives.MaxAge != -1 ||
+		(obj.RespDirectives.SMaxAge != -1 && !obj.CacheIsPrivate) ||
+		statusCachable ||
+		obj.RespDirectives.Public {
+		/* cachable by default, at least one of the above conditions was true */
+	} else {
+		rv.OutReasons = append(rv.OutReasons, ReasonResponseUncachableByDefault)
+	}
+}
+
+var twentyFourHours = time.Duration(24 * time.Hour)
+
+const debug = false
+
+// LOW LEVEL API: Update an objects expiration time.
+func ExpirationObject(obj *Object, rv *ObjectResults) {
+	/**
+	 * Okay, lets calculate Freshness/Expiration now. woo:
+	 *  http://tools.ietf.org/html/rfc7234#section-4.2
+	 */
+
+	/*
+	   o  If the cache is shared and the s-maxage response directive
+	      (Section 5.2.2.9) is present, use its value, or
+
+	   o  If the max-age response directive (Section 5.2.2.8) is present,
+	      use its value, or
+
+	   o  If the Expires response header field (Section 5.3) is present, use
+	      its value minus the value of the Date response header field, or
+
+	   o  Otherwise, no explicit expiration time is present in the response.
+	      A heuristic freshness lifetime might be applicable; see
+	      Section 4.2.2.
+	*/
+
+	var expiresTime time.Time
+
+	if obj.RespDirectives.SMaxAge != -1 && !obj.CacheIsPrivate {
+		expiresTime = obj.NowUTC.Add(time.Second * time.Duration(obj.RespDirectives.SMaxAge))
+	} else if obj.RespDirectives.MaxAge != -1 {
+		expiresTime = obj.NowUTC.UTC().Add(time.Second * time.Duration(obj.RespDirectives.MaxAge))
+	} else if !obj.RespExpiresHeader.IsZero() {
+		serverDate := obj.RespDateHeader
+		if serverDate.IsZero() {
+			// common enough case when a Date: header has not yet been added to an
+			// active response.
+			serverDate = obj.NowUTC
+		}
+		expiresTime = obj.NowUTC.Add(obj.RespExpiresHeader.Sub(serverDate))
+	} else if !obj.RespLastModifiedHeader.IsZero() {
+		// heuristic freshness lifetime
+		rv.OutWarnings = append(rv.OutWarnings, WarningHeuristicExpiration)
+
+		// http://httpd.apache.org/docs/2.4/mod/mod_cache.html#cachelastmodifiedfactor
+		// CacheMaxExpire defaults to 24 hours
+		// CacheLastModifiedFactor: is 0.1
+		//
+		// expiry-period = MIN(time-since-last-modified-date * factor, 24 hours)
+		//
+		// obj.NowUTC
+
+		since := obj.RespLastModifiedHeader.Sub(obj.NowUTC)
+		since = time.Duration(float64(since) * -0.1)
+
+		if since > twentyFourHours {
+			expiresTime = obj.NowUTC.Add(twentyFourHours)
+		} else {
+			expiresTime = obj.NowUTC.Add(since)
+		}
+
+		if debug {
+			println("Now UTC: ", obj.NowUTC.String())
+			println("Last-Modified: ", obj.RespLastModifiedHeader.String())
+			println("Since: ", since.String())
+			println("TwentyFourHours: ", twentyFourHours.String())
+			println("Expiration: ", expiresTime.String())
+		}
+	} else {
+		// TODO(pquerna): what should the default behavoir be for expiration time?
+	}
+
+	rv.OutExpirationTime = expiresTime
+}
+
+// Evaluate cachability based on an HTTP request, and parts of the response.
+func UsingRequestResponse(req *http.Request,
+	statusCode int,
+	respHeaders http.Header,
+	privateCache bool) ([]Reason, time.Time, error) {
+	reasons, time, _, _, err := UsingRequestResponseWithObject(req, statusCode, respHeaders, privateCache)
+	return reasons, time, err
+}
+
+// Evaluate cachability based on an HTTP request, and parts of the response.
+// Returns the parsed Object as well.
+func UsingRequestResponseWithObject(req *http.Request,
+	statusCode int,
+	respHeaders http.Header,
+	privateCache bool) ([]Reason, time.Time, []Warning, *Object, error) {
+	var reqHeaders http.Header
+	var reqMethod string
+
+	var reqDir *RequestCacheDirectives = nil
+	respDir, err := ParseResponseCacheControl(respHeaders.Get("Cache-Control"))
+	if err != nil {
+		return nil, time.Time{}, nil, nil, err
+	}
+
+	if req != nil {
+		reqDir, err = ParseRequestCacheControl(req.Header.Get("Cache-Control"))
+		if err != nil {
+			return nil, time.Time{}, nil, nil, err
+		}
+		reqHeaders = req.Header
+		reqMethod = req.Method
+	}
+
+	var expiresHeader time.Time
+	var dateHeader time.Time
+	var lastModifiedHeader time.Time
+
+	if respHeaders.Get("Expires") != "" {
+		expiresHeader, err = http.ParseTime(respHeaders.Get("Expires"))
+		if err != nil {
+			// sometimes servers will return `Expires: 0` or `Expires: -1` to
+			// indicate expired content
+			expiresHeader = time.Time{}
+		}
+		expiresHeader = expiresHeader.UTC()
+	}
+
+	if respHeaders.Get("Date") != "" {
+		dateHeader, err = http.ParseTime(respHeaders.Get("Date"))
+		if err != nil {
+			return nil, time.Time{}, nil, nil, err
+		}
+		dateHeader = dateHeader.UTC()
+	}
+
+	if respHeaders.Get("Last-Modified") != "" {
+		lastModifiedHeader, err = http.ParseTime(respHeaders.Get("Last-Modified"))
+		if err != nil {
+			return nil, time.Time{}, nil, nil, err
+		}
+		lastModifiedHeader = lastModifiedHeader.UTC()
+	}
+
+	obj := Object{
+		CacheIsPrivate: privateCache,
+
+		RespDirectives:         respDir,
+		RespHeaders:            respHeaders,
+		RespStatusCode:         statusCode,
+		RespExpiresHeader:      expiresHeader,
+		RespDateHeader:         dateHeader,
+		RespLastModifiedHeader: lastModifiedHeader,
+
+		ReqDirectives: reqDir,
+		ReqHeaders:    reqHeaders,
+		ReqMethod:     reqMethod,
+
+		NowUTC: time.Now().UTC(),
+	}
+	rv := ObjectResults{}
+
+	CachableObject(&obj, &rv)
+	if rv.OutErr != nil {
+		return nil, time.Time{}, nil, nil, rv.OutErr
+	}
+
+	ExpirationObject(&obj, &rv)
+	if rv.OutErr != nil {
+		return nil, time.Time{}, nil, nil, rv.OutErr
+	}
+
+	return rv.OutReasons, rv.OutExpirationTime, rv.OutWarnings, &obj, nil
+}
+
+// calculate if a freshness directive is present: http://tools.ietf.org/html/rfc7234#section-4.2.1
+func hasFreshness(reqDir *RequestCacheDirectives, respDir *ResponseCacheDirectives, respHeaders http.Header, respExpires time.Time, privateCache bool) bool {
+	if !privateCache && respDir.SMaxAge != -1 {
+		return true
+	}
+
+	if respDir.MaxAge != -1 {
+		return true
+	}
+
+	if !respExpires.IsZero() || respHeaders.Get("Expires") != "" {
+		return true
+	}
+
+	return false
+}
+
+func cachableStatusCode(statusCode int) bool {
+	/*
+		Responses with status codes that are defined as cacheable by default
+		(e.g., 200, 203, 204, 206, 300, 301, 404, 405, 410, 414, and 501 in
+		this specification) can be reused by a cache with heuristic
+		expiration unless otherwise indicated by the method definition or
+		explicit cache controls [RFC7234]; all other status codes are not
+		cacheable by default.
+	*/
+	switch statusCode {
+	case 200:
+		return true
+	case 203:
+		return true
+	case 204:
+		return true
+	case 206:
+		return true
+	case 300:
+		return true
+	case 301:
+		return true
+	case 404:
+		return true
+	case 405:
+		return true
+	case 410:
+		return true
+	case 414:
+		return true
+	case 501:
+		return true
+	default:
+		return false
+	}
+}
diff --git a/vendor/github.com/pquerna/cachecontrol/cacheobject/object_http_test.go b/vendor/github.com/pquerna/cachecontrol/cacheobject/object_http_test.go
new file mode 100644
index 0000000..5d77f57
--- /dev/null
+++ b/vendor/github.com/pquerna/cachecontrol/cacheobject/object_http_test.go
@@ -0,0 +1,91 @@
+/**
+ *  Copyright 2015 Paul Querna
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package cacheobject
+
+import (
+	"github.com/stretchr/testify/require"
+
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+)
+
+func roundTrip(t *testing.T, fnc func(w http.ResponseWriter, r *http.Request)) (*http.Request, *http.Response) {
+	ts := httptest.NewServer(http.HandlerFunc(fnc))
+	defer ts.Close()
+
+	req, err := http.NewRequest("GET", ts.URL, nil)
+	require.NoError(t, err)
+
+	res, err := http.DefaultClient.Do(req)
+	require.NoError(t, err)
+
+	_, err = ioutil.ReadAll(res.Body)
+	res.Body.Close()
+	require.NoError(t, err)
+	return req, res
+}
+
+func TestCachableResponsePublic(t *testing.T) {
+	req, res := roundTrip(t, func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.Header().Set("Cache-Control", "public")
+		w.Header().Set("Last-Modified",
+			time.Now().UTC().Add(time.Duration(time.Hour*-5)).Format(http.TimeFormat))
+		fmt.Fprintln(w, `{}`)
+	})
+
+	reasons, expires, err := UsingRequestResponse(req, res.StatusCode, res.Header, false)
+
+	require.NoError(t, err)
+	require.Len(t, reasons, 0)
+	require.WithinDuration(t,
+		time.Now().UTC().Add(time.Duration(float64(time.Hour)*0.5)),
+		expires,
+		10*time.Second)
+}
+
+func TestCachableResponseNoHeaders(t *testing.T) {
+	req, res := roundTrip(t, func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		fmt.Fprintln(w, `{}`)
+	})
+
+	reasons, expires, err := UsingRequestResponse(req, res.StatusCode, res.Header, false)
+
+	require.NoError(t, err)
+	require.Len(t, reasons, 0)
+	require.True(t, expires.IsZero())
+}
+
+func TestCachableResponseBadExpires(t *testing.T) {
+	req, res := roundTrip(t, func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.Header().Set("Expires", "-1")
+		fmt.Fprintln(w, `{}`)
+	})
+
+	reasons, expires, err := UsingRequestResponse(req, res.StatusCode, res.Header, false)
+
+	require.NoError(t, err)
+	require.Len(t, reasons, 0)
+	require.True(t, expires.IsZero())
+}
diff --git a/vendor/github.com/pquerna/cachecontrol/cacheobject/object_test.go b/vendor/github.com/pquerna/cachecontrol/cacheobject/object_test.go
new file mode 100644
index 0000000..6986a7e
--- /dev/null
+++ b/vendor/github.com/pquerna/cachecontrol/cacheobject/object_test.go
@@ -0,0 +1,394 @@
+/**
+ *  Copyright 2015 Paul Querna
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package cacheobject
+
+import (
+	"github.com/stretchr/testify/require"
+
+	"net/http"
+	"testing"
+	"time"
+)
+
+func TestCachableStatusCode(t *testing.T) {
+	ok := []int{200, 203, 204, 206, 300, 301, 404, 405, 410, 414, 501}
+	for _, v := range ok {
+		require.True(t, cachableStatusCode(v), "status code should be cacheable: %d", v)
+	}
+
+	notok := []int{201, 429, 500, 504}
+	for _, v := range notok {
+		require.False(t, cachableStatusCode(v), "status code should not be cachable: %d", v)
+	}
+}
+
+func fill(t *testing.T, now time.Time) Object {
+	RespDirectives, err := ParseResponseCacheControl("")
+	require.NoError(t, err)
+	ReqDirectives, err := ParseRequestCacheControl("")
+	require.NoError(t, err)
+
+	obj := Object{
+		RespDirectives: RespDirectives,
+		RespHeaders:    http.Header{},
+		RespStatusCode: 200,
+		RespDateHeader: now,
+
+		ReqDirectives: ReqDirectives,
+		ReqHeaders:    http.Header{},
+		ReqMethod:     "GET",
+
+		NowUTC: now,
+	}
+
+	return obj
+}
+
+func TestGETPrivate(t *testing.T) {
+	now := time.Now().UTC()
+
+	obj := fill(t, now)
+	RespDirectives, err := ParseResponseCacheControl("private")
+	require.NoError(t, err)
+
+	obj.RespDirectives = RespDirectives
+
+	rv := ObjectResults{}
+	CachableObject(&obj, &rv)
+	require.NoError(t, rv.OutErr)
+	require.Len(t, rv.OutReasons, 1)
+	require.Contains(t, rv.OutReasons, ReasonResponsePrivate)
+}
+
+func TestGETPrivateWithPrivateCache(t *testing.T) {
+	now := time.Now().UTC()
+
+	obj := fill(t, now)
+	RespDirectives, err := ParseResponseCacheControl("private")
+	require.NoError(t, err)
+
+	obj.CacheIsPrivate = true
+	obj.RespDirectives = RespDirectives
+
+	rv := ObjectResults{}
+	CachableObject(&obj, &rv)
+	require.NoError(t, rv.OutErr)
+	require.Len(t, rv.OutReasons, 0)
+}
+
+func TestUncachableMethods(t *testing.T) {
+	type methodPair struct {
+		m string
+		r Reason
+	}
+
+	tc := []methodPair{
+		{"PUT", ReasonRequestMethodPUT},
+		{"DELETE", ReasonRequestMethodDELETE},
+		{"CONNECT", ReasonRequestMethodCONNECT},
+		{"OPTIONS", ReasonRequestMethodOPTIONS},
+		{"CONNECT", ReasonRequestMethodCONNECT},
+		{"TRACE", ReasonRequestMethodTRACE},
+		{"MADEUP", ReasonRequestMethodUnkown},
+	}
+
+	for _, mp := range tc {
+		now := time.Now().UTC()
+
+		obj := fill(t, now)
+		obj.ReqMethod = mp.m
+
+		rv := ObjectResults{}
+		CachableObject(&obj, &rv)
+		require.NoError(t, rv.OutErr)
+		require.Len(t, rv.OutReasons, 1)
+		require.Contains(t, rv.OutReasons, mp.r)
+	}
+}
+
+func TestHEAD(t *testing.T) {
+	now := time.Now().UTC()
+
+	obj := fill(t, now)
+	obj.ReqMethod = "HEAD"
+	obj.RespLastModifiedHeader = now.Add(time.Hour * -1)
+
+	rv := ObjectResults{}
+	CachableObject(&obj, &rv)
+	require.NoError(t, rv.OutErr)
+	require.Len(t, rv.OutReasons, 0)
+
+	ExpirationObject(&obj, &rv)
+	require.NoError(t, rv.OutErr)
+	require.Len(t, rv.OutReasons, 0)
+	require.False(t, rv.OutExpirationTime.IsZero())
+}
+
+func TestHEADLongLastModified(t *testing.T) {
+	now := time.Now().UTC()
+
+	obj := fill(t, now)
+	obj.ReqMethod = "HEAD"
+	obj.RespLastModifiedHeader = now.Add(time.Hour * -70000)
+
+	rv := ObjectResults{}
+	CachableObject(&obj, &rv)
+	require.NoError(t, rv.OutErr)
+	require.Len(t, rv.OutReasons, 0)
+
+	ExpirationObject(&obj, &rv)
+	require.NoError(t, rv.OutErr)
+	require.Len(t, rv.OutReasons, 0)
+	require.False(t, rv.OutExpirationTime.IsZero())
+	require.WithinDuration(t, now.Add(twentyFourHours), rv.OutExpirationTime, time.Second*60)
+}
+
+func TestNonCachablePOST(t *testing.T) {
+	now := time.Now().UTC()
+
+	obj := fill(t, now)
+	obj.ReqMethod = "POST"
+
+	rv := ObjectResults{}
+	CachableObject(&obj, &rv)
+	require.NoError(t, rv.OutErr)
+	require.Len(t, rv.OutReasons, 1)
+	require.Contains(t, rv.OutReasons, ReasonRequestMethodPOST)
+}
+
+func TestCachablePOSTExpiresHeader(t *testing.T) {
+	now := time.Now().UTC()
+
+	obj := fill(t, now)
+	obj.ReqMethod = "POST"
+	obj.RespExpiresHeader = now.Add(time.Hour * 1)
+
+	rv := ObjectResults{}
+	CachableObject(&obj, &rv)
+	require.NoError(t, rv.OutErr)
+	require.Len(t, rv.OutReasons, 0)
+}
+
+func TestCachablePOSTSMax(t *testing.T) {
+	now := time.Now().UTC()
+
+	obj := fill(t, now)
+	obj.ReqMethod = "POST"
+	obj.RespDirectives.SMaxAge = DeltaSeconds(900)
+
+	rv := ObjectResults{}
+	CachableObject(&obj, &rv)
+	require.NoError(t, rv.OutErr)
+	require.Len(t, rv.OutReasons, 0)
+}
+
+func TestNonCachablePOSTSMax(t *testing.T) {
+	now := time.Now().UTC()
+
+	obj := fill(t, now)
+	obj.ReqMethod = "POST"
+	obj.CacheIsPrivate = true
+	obj.RespDirectives.SMaxAge = DeltaSeconds(900)
+
+	rv := ObjectResults{}
+	CachableObject(&obj, &rv)
+	require.NoError(t, rv.OutErr)
+	require.Len(t, rv.OutReasons, 1)
+	require.Contains(t, rv.OutReasons, ReasonRequestMethodPOST)
+}
+
+func TestCachablePOSTMax(t *testing.T) {
+	now := time.Now().UTC()
+
+	obj := fill(t, now)
+	obj.ReqMethod = "POST"
+	obj.RespDirectives.MaxAge = DeltaSeconds(9000)
+
+	rv := ObjectResults{}
+	CachableObject(&obj, &rv)
+	require.NoError(t, rv.OutErr)
+	require.Len(t, rv.OutReasons, 0)
+}
+
+func TestPUTs(t *testing.T) {
+	now := time.Now().UTC()
+
+	obj := fill(t, now)
+	obj.ReqMethod = "PUT"
+
+	rv := ObjectResults{}
+	CachableObject(&obj, &rv)
+	require.NoError(t, rv.OutErr)
+	require.Len(t, rv.OutReasons, 1)
+	require.Contains(t, rv.OutReasons, ReasonRequestMethodPUT)
+}
+
+func TestPUTWithExpires(t *testing.T) {
+	now := time.Now().UTC()
+
+	obj := fill(t, now)
+	obj.ReqMethod = "PUT"
+	obj.RespExpiresHeader = now.Add(time.Hour * 1)
+
+	rv := ObjectResults{}
+	CachableObject(&obj, &rv)
+	require.NoError(t, rv.OutErr)
+	require.Len(t, rv.OutReasons, 1)
+	require.Contains(t, rv.OutReasons, ReasonRequestMethodPUT)
+}
+
+func TestAuthorization(t *testing.T) {
+	now := time.Now().UTC()
+
+	obj := fill(t, now)
+	obj.ReqHeaders.Set("Authorization", "bearer random")
+
+	rv := ObjectResults{}
+	CachableObject(&obj, &rv)
+	require.NoError(t, rv.OutErr)
+	require.Len(t, rv.OutReasons, 1)
+	require.Contains(t, rv.OutReasons, ReasonRequestAuthorizationHeader)
+}
+
+func TestCachableAuthorization(t *testing.T) {
+	now := time.Now().UTC()
+
+	obj := fill(t, now)
+	obj.ReqHeaders.Set("Authorization", "bearer random")
+	obj.RespDirectives.Public = true
+	obj.RespDirectives.MaxAge = DeltaSeconds(300)
+
+	rv := ObjectResults{}
+	CachableObject(&obj, &rv)
+	require.NoError(t, rv.OutErr)
+	require.Len(t, rv.OutReasons, 0)
+}
+
+func TestRespNoStore(t *testing.T) {
+	now := time.Now().UTC()
+
+	obj := fill(t, now)
+	obj.RespDirectives.NoStore = true
+
+	rv := ObjectResults{}
+	CachableObject(&obj, &rv)
+	require.Len(t, rv.OutReasons, 1)
+	require.Contains(t, rv.OutReasons, ReasonResponseNoStore)
+}
+
+func TestReqNoStore(t *testing.T) {
+	now := time.Now().UTC()
+
+	obj := fill(t, now)
+	obj.ReqDirectives.NoStore = true
+
+	rv := ObjectResults{}
+	CachableObject(&obj, &rv)
+	require.Len(t, rv.OutReasons, 1)
+	require.Contains(t, rv.OutReasons, ReasonRequestNoStore)
+}
+
+func TestResp500(t *testing.T) {
+	now := time.Now().UTC()
+
+	obj := fill(t, now)
+	obj.RespStatusCode = 500
+
+	rv := ObjectResults{}
+	CachableObject(&obj, &rv)
+	require.Len(t, rv.OutReasons, 1)
+	require.Contains(t, rv.OutReasons, ReasonResponseUncachableByDefault)
+}
+
+func TestExpirationSMaxShared(t *testing.T) {
+	now := time.Now().UTC()
+
+	obj := fill(t, now)
+	obj.RespDirectives.SMaxAge = DeltaSeconds(60)
+
+	rv := ObjectResults{}
+	ExpirationObject(&obj, &rv)
+	require.Len(t, rv.OutWarnings, 0)
+	require.WithinDuration(t, now.Add(time.Second*60), rv.OutExpirationTime, time.Second*1)
+}
+
+func TestExpirationSMaxPrivate(t *testing.T) {
+	now := time.Now().UTC()
+
+	obj := fill(t, now)
+	obj.CacheIsPrivate = true
+	obj.RespDirectives.SMaxAge = DeltaSeconds(60)
+
+	rv := ObjectResults{}
+	ExpirationObject(&obj, &rv)
+	require.Len(t, rv.OutWarnings, 0)
+	require.True(t, rv.OutExpirationTime.IsZero())
+}
+
+func TestExpirationMax(t *testing.T) {
+	now := time.Now().UTC()
+
+	obj := fill(t, now)
+	obj.RespDirectives.MaxAge = DeltaSeconds(60)
+
+	rv := ObjectResults{}
+	ExpirationObject(&obj, &rv)
+	require.Len(t, rv.OutWarnings, 0)
+	require.WithinDuration(t, now.Add(time.Second*60), rv.OutExpirationTime, time.Second*1)
+}
+
+func TestExpirationMaxAndSMax(t *testing.T) {
+	now := time.Now().UTC()
+
+	obj := fill(t, now)
+	// cache should select the SMax age since this is a shared cache.
+	obj.RespDirectives.MaxAge = DeltaSeconds(60)
+	obj.RespDirectives.SMaxAge = DeltaSeconds(900)
+
+	rv := ObjectResults{}
+	ExpirationObject(&obj, &rv)
+	require.Len(t, rv.OutWarnings, 0)
+	require.WithinDuration(t, now.Add(time.Second*900), rv.OutExpirationTime, time.Second*1)
+}
+
+func TestExpirationExpires(t *testing.T) {
+	now := time.Now().UTC()
+
+	obj := fill(t, now)
+	// cache should select the SMax age since this is a shared cache.
+	obj.RespExpiresHeader = now.Add(time.Second * 1500)
+
+	rv := ObjectResults{}
+	ExpirationObject(&obj, &rv)
+	require.Len(t, rv.OutWarnings, 0)
+	require.WithinDuration(t, now.Add(time.Second*1500), rv.OutExpirationTime, time.Second*1)
+}
+
+func TestExpirationExpiresNoServerDate(t *testing.T) {
+	now := time.Now().UTC()
+
+	obj := fill(t, now)
+	// cache should select the SMax age since this is a shared cache.
+	obj.RespDateHeader = time.Time{}
+	obj.RespExpiresHeader = now.Add(time.Second * 1500)
+
+	rv := ObjectResults{}
+	ExpirationObject(&obj, &rv)
+	require.Len(t, rv.OutWarnings, 0)
+	require.WithinDuration(t, now.Add(time.Second*1500), rv.OutExpirationTime, time.Second*1)
+}
diff --git a/vendor/github.com/pquerna/cachecontrol/cacheobject/reasons.go b/vendor/github.com/pquerna/cachecontrol/cacheobject/reasons.go
new file mode 100644
index 0000000..f53d1ad
--- /dev/null
+++ b/vendor/github.com/pquerna/cachecontrol/cacheobject/reasons.go
@@ -0,0 +1,95 @@
+/**
+ *  Copyright 2015 Paul Querna
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package cacheobject
+
+// Repersents a potential Reason to not cache an object.
+//
+// Applications may wish to ignore specific reasons, which will make them non-RFC
+// compliant, but this type gives them specific cases they can choose to ignore,
+// making them compliant in as many cases as they can.
+type Reason int
+
+const (
+
+	// The request method was POST and an Expiration header was not supplied.
+	ReasonRequestMethodPOST Reason = iota
+
+	// The request method was PUT and PUTs are not cachable.
+	ReasonRequestMethodPUT
+
+	// The request method was DELETE and DELETEs are not cachable.
+	ReasonRequestMethodDELETE
+
+	// The request method was CONNECT and CONNECTs are not cachable.
+	ReasonRequestMethodCONNECT
+
+	// The request method was OPTIONS and OPTIONS are not cachable.
+	ReasonRequestMethodOPTIONS
+
+	// The request method was TRACE and TRACEs are not cachable.
+	ReasonRequestMethodTRACE
+
+	// The request method was not recognized by cachecontrol, and should not be cached.
+	ReasonRequestMethodUnkown
+
+	// The request included an Cache-Control: no-store header
+	ReasonRequestNoStore
+
+	// The request included an Authorization header without an explicit Public or Expiration time: http://tools.ietf.org/html/rfc7234#section-3.2
+	ReasonRequestAuthorizationHeader
+
+	// The response included an Cache-Control: no-store header
+	ReasonResponseNoStore
+
+	// The response included an Cache-Control: private header and this is not a Private cache
+	ReasonResponsePrivate
+
+	// The response failed to meet at least one of the conditions specified in RFC 7234 section 3: http://tools.ietf.org/html/rfc7234#section-3
+	ReasonResponseUncachableByDefault
+)
+
+func (r Reason) String() string {
+	switch r {
+	case ReasonRequestMethodPOST:
+		return "ReasonRequestMethodPOST"
+	case ReasonRequestMethodPUT:
+		return "ReasonRequestMethodPUT"
+	case ReasonRequestMethodDELETE:
+		return "ReasonRequestMethodDELETE"
+	case ReasonRequestMethodCONNECT:
+		return "ReasonRequestMethodCONNECT"
+	case ReasonRequestMethodOPTIONS:
+		return "ReasonRequestMethodOPTIONS"
+	case ReasonRequestMethodTRACE:
+		return "ReasonRequestMethodTRACE"
+	case ReasonRequestMethodUnkown:
+		return "ReasonRequestMethodUnkown"
+	case ReasonRequestNoStore:
+		return "ReasonRequestNoStore"
+	case ReasonRequestAuthorizationHeader:
+		return "ReasonRequestAuthorizationHeader"
+	case ReasonResponseNoStore:
+		return "ReasonResponseNoStore"
+	case ReasonResponsePrivate:
+		return "ReasonResponsePrivate"
+	case ReasonResponseUncachableByDefault:
+		return "ReasonResponseUncachableByDefault"
+	}
+
+	panic(r)
+}
diff --git a/vendor/github.com/pquerna/cachecontrol/cacheobject/warning.go b/vendor/github.com/pquerna/cachecontrol/cacheobject/warning.go
new file mode 100644
index 0000000..82f8941
--- /dev/null
+++ b/vendor/github.com/pquerna/cachecontrol/cacheobject/warning.go
@@ -0,0 +1,107 @@
+/**
+ *  Copyright 2015 Paul Querna
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package cacheobject
+
+import (
+	"fmt"
+	"net/http"
+	"time"
+)
+
+// Repersents an HTTP Warning: http://tools.ietf.org/html/rfc7234#section-5.5
+type Warning int
+
+const (
+	// Response is Stale
+	// A cache SHOULD generate this whenever the sent response is stale.
+	WarningResponseIsStale Warning = 110
+
+	// Revalidation Failed
+	// A cache SHOULD generate this when sending a stale
+	// response because an attempt to validate the response failed, due to an
+	// inability to reach the server.
+	WarningRevalidationFailed Warning = 111
+
+	// Disconnected Operation
+	// A cache SHOULD generate this if it is intentionally disconnected from
+	// the rest of the network for a period of time.
+	WarningDisconnectedOperation Warning = 112
+
+	// Heuristic Expiration
+	//
+	// A cache SHOULD generate this if it heuristically chose a freshness
+	// lifetime greater than 24 hours and the response's age is greater than
+	// 24 hours.
+	WarningHeuristicExpiration Warning = 113
+
+	// Miscellaneous Warning
+	//
+	// The warning text can include arbitrary information to be presented to
+	// a human user or logged.  A system receiving this warning MUST NOT
+	// take any automated action, besides presenting the warning to the
+	// user.
+	WarningMiscellaneousWarning Warning = 199
+
+	// Transformation Applied
+	//
+	// This Warning code MUST be added by a proxy if it applies any
+	// transformation to the representation, such as changing the
+	// content-coding, media-type, or modifying the representation data,
+	// unless this Warning code already appears in the response.
+	WarningTransformationApplied Warning = 214
+
+	// Miscellaneous Persistent Warning
+	//
+	// The warning text can include arbitrary information to be presented to
+	// a human user or logged.  A system receiving this warning MUST NOT
+	// take any automated action.
+	WarningMiscellaneousPersistentWarning Warning = 299
+)
+
+func (w Warning) HeaderString(agent string, date time.Time) string {
+	if agent == "" {
+		agent = "-"
+	} else {
+		// TODO(pquerna): this doesn't escape agent if it contains bad things.
+		agent = `"` + agent + `"`
+	}
+	return fmt.Sprintf(`%d %s "%s" %s`, w, agent, w.String(), date.Format(http.TimeFormat))
+}
+
+func (w Warning) String() string {
+	switch w {
+	case WarningResponseIsStale:
+		return "Response is Stale"
+	case WarningRevalidationFailed:
+		return "Revalidation Failed"
+	case WarningDisconnectedOperation:
+		return "Disconnected Operation"
+	case WarningHeuristicExpiration:
+		return "Heuristic Expiration"
+	case WarningMiscellaneousWarning:
+		// TODO(pquerna): ideally had a better way to override this one code.
+		return "Miscellaneous Warning"
+	case WarningTransformationApplied:
+		return "Transformation Applied"
+	case WarningMiscellaneousPersistentWarning:
+		// TODO(pquerna): same as WarningMiscellaneousWarning
+		return "Miscellaneous Persistent Warning"
+	}
+
+	panic(w)
+}
diff --git a/vendor/github.com/pquerna/cachecontrol/doc.go b/vendor/github.com/pquerna/cachecontrol/doc.go
new file mode 100644
index 0000000..3fe7ed0
--- /dev/null
+++ b/vendor/github.com/pquerna/cachecontrol/doc.go
@@ -0,0 +1,25 @@
+/**
+ *  Copyright 2015 Paul Querna
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+// Package cachecontrol implements the logic for HTTP Caching
+//
+// Deciding if an HTTP Response can be cached is often harder
+// and more bug prone than an actual cache storage backend.
+// cachecontrol provides a simple interface to determine if
+// request and response pairs are cachable as defined under
+// RFC 7234 http://tools.ietf.org/html/rfc7234
+package cachecontrol
diff --git a/vendor/github.com/pquerna/cachecontrol/examples/example-com.go b/vendor/github.com/pquerna/cachecontrol/examples/example-com.go
new file mode 100644
index 0000000..795c679
--- /dev/null
+++ b/vendor/github.com/pquerna/cachecontrol/examples/example-com.go
@@ -0,0 +1,21 @@
+package main
+
+import (
+	"github.com/pquerna/cachecontrol"
+
+	"fmt"
+	"io/ioutil"
+	"net/http"
+)
+
+func main() {
+	req, _ := http.NewRequest("GET", "http://www.example.com/", nil)
+
+	res, _ := http.DefaultClient.Do(req)
+	_, _ = ioutil.ReadAll(res.Body)
+
+	reasons, expires, _ := cachecontrol.CachableResponse(req, res, cachecontrol.Options{})
+
+	fmt.Println("Reasons to not cache: ", reasons)
+	fmt.Println("Expiration: ", expires.String())
+}
diff --git a/vendor/github.com/pquerna/cachecontrol/examples/lowlevel/ll-example-com.go b/vendor/github.com/pquerna/cachecontrol/examples/lowlevel/ll-example-com.go
new file mode 100644
index 0000000..7d3e8c3
--- /dev/null
+++ b/vendor/github.com/pquerna/cachecontrol/examples/lowlevel/ll-example-com.go
@@ -0,0 +1,48 @@
+package main
+
+import (
+	"github.com/pquerna/cachecontrol/cacheobject"
+
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"time"
+)
+
+func main() {
+	req, _ := http.NewRequest("GET", "http://www.example.com/", nil)
+
+	res, _ := http.DefaultClient.Do(req)
+	_, _ = ioutil.ReadAll(res.Body)
+
+	reqDir, _ := cacheobject.ParseRequestCacheControl(req.Header.Get("Cache-Control"))
+
+	resDir, _ := cacheobject.ParseResponseCacheControl(res.Header.Get("Cache-Control"))
+	expiresHeader, _ := http.ParseTime(res.Header.Get("Expires"))
+	dateHeader, _ := http.ParseTime(res.Header.Get("Date"))
+	lastModifiedHeader, _ := http.ParseTime(res.Header.Get("Last-Modified"))
+
+	obj := cacheobject.Object{
+		RespDirectives:         resDir,
+		RespHeaders:            res.Header,
+		RespStatusCode:         res.StatusCode,
+		RespExpiresHeader:      expiresHeader,
+		RespDateHeader:         dateHeader,
+		RespLastModifiedHeader: lastModifiedHeader,
+
+		ReqDirectives: reqDir,
+		ReqHeaders:    req.Header,
+		ReqMethod:     req.Method,
+
+		NowUTC: time.Now().UTC(),
+	}
+	rv := cacheobject.ObjectResults{}
+
+	cacheobject.CachableObject(&obj, &rv)
+	cacheobject.ExpirationObject(&obj, &rv)
+
+	fmt.Println("Errors: ", rv.OutErr)
+	fmt.Println("Reasons to not cache: ", rv.OutReasons)
+	fmt.Println("Warning headers to add: ", rv.OutWarnings)
+	fmt.Println("Expiration: ", rv.OutExpirationTime.String())
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/.gitcookies.sh.enc b/vendor/gopkg.in/square/go-jose.v2/.gitcookies.sh.enc
new file mode 100644
index 0000000..730e569
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/.gitcookies.sh.enc
@@ -0,0 +1 @@
+'|Ê&{tÄU|gGê(ì�Cy=+¨œòcû:u:/pœ#~žü["±4¤!­nÙAªDK<ŠufÿhÅa¿Â:ºü¸¡´B/£Ø¤¹¤ò_�hÎÛSãT*wÌx¼¯�¹-ç|�àÀÓƒÑÄäóÌ㣗A$$â6£ÁâG)8nÏpûÆË¡3ÌšœoïÏvŽB–3¿­]xÝ“Ó2l§G•|qRÞ¯
ö2
5R–Ó×Ç$´ñ½Yè¡ÞÝ™l‘Ë«yAI"ÛŒ˜®íû¹¼kÄ|Kåþ[9ÆâÒå=°úÿŸñ|@S•3ó#æ�x?¾V„,¾‚SÆÝõœwPíogÒ6&V6	©D.dBŠ7
\ No newline at end of file
diff --git a/vendor/gopkg.in/square/go-jose.v2/.gitignore b/vendor/gopkg.in/square/go-jose.v2/.gitignore
new file mode 100644
index 0000000..5b4d73b
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/.gitignore
@@ -0,0 +1,7 @@
+*~
+.*.swp
+*.out
+*.test
+*.pem
+*.cov
+jose-util/jose-util
diff --git a/vendor/gopkg.in/square/go-jose.v2/.travis.yml b/vendor/gopkg.in/square/go-jose.v2/.travis.yml
new file mode 100644
index 0000000..fc501ca
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/.travis.yml
@@ -0,0 +1,46 @@
+language: go
+
+sudo: false
+
+matrix:
+  fast_finish: true
+  allow_failures:
+    - go: tip
+
+go:
+- '1.7.x'
+- '1.8.x'
+- '1.9.x'
+- '1.10.x'
+- '1.11.x'
+
+go_import_path: gopkg.in/square/go-jose.v2
+
+before_script:
+- export PATH=$HOME/.local/bin:$PATH
+
+before_install:
+# Install encrypted gitcookies to get around bandwidth-limits
+# that is causing Travis-CI builds to fail. For more info, see
+# https://github.com/golang/go/issues/12933
+- openssl aes-256-cbc -K $encrypted_1528c3c2cafd_key -iv $encrypted_1528c3c2cafd_iv -in .gitcookies.sh.enc -out .gitcookies.sh -d || true
+- bash .gitcookies.sh || true
+- go get github.com/wadey/gocovmerge
+- go get github.com/mattn/goveralls
+- go get github.com/stretchr/testify/assert
+- go get golang.org/x/tools/cmd/cover || true
+- go get code.google.com/p/go.tools/cmd/cover || true
+- pip install cram --user
+
+script:
+- go test . -v -covermode=count -coverprofile=profile.cov
+- go test ./cipher -v -covermode=count -coverprofile=cipher/profile.cov
+- go test ./jwt -v -covermode=count -coverprofile=jwt/profile.cov
+- go test ./json -v # no coverage for forked encoding/json package
+- cd jose-util && go build && PATH=$PWD:$PATH cram -v jose-util.t
+- cd ..
+
+after_success:
+- gocovmerge *.cov */*.cov > merged.coverprofile
+- $HOME/gopath/bin/goveralls -coverprofile merged.coverprofile -service=travis-ci
+
diff --git a/vendor/gopkg.in/square/go-jose.v2/BUG-BOUNTY.md b/vendor/gopkg.in/square/go-jose.v2/BUG-BOUNTY.md
new file mode 100644
index 0000000..3305db0
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/BUG-BOUNTY.md
@@ -0,0 +1,10 @@
+Serious about security
+======================
+
+Square recognizes the important contributions the security research community
+can make. We therefore encourage reporting security issues with the code
+contained in this repository.
+
+If you believe you have discovered a security vulnerability, please follow the
+guidelines at <https://bugcrowd.com/squareopensource>.
+
diff --git a/vendor/gopkg.in/square/go-jose.v2/CONTRIBUTING.md b/vendor/gopkg.in/square/go-jose.v2/CONTRIBUTING.md
new file mode 100644
index 0000000..61b1836
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/CONTRIBUTING.md
@@ -0,0 +1,14 @@
+# Contributing
+
+If you would like to contribute code to go-jose you can do so through GitHub by
+forking the repository and sending a pull request.
+
+When submitting code, please make every effort to follow existing conventions
+and style in order to keep the code as readable as possible. Please also make
+sure all tests pass by running `go test`, and format your code with `go fmt`.
+We also recommend using `golint` and `errcheck`.
+
+Before your code can be accepted into the project you must also sign the
+[Individual Contributor License Agreement][1].
+
+ [1]: https://spreadsheets.google.com/spreadsheet/viewform?formkey=dDViT2xzUHAwRkI3X3k5Z0lQM091OGc6MQ&ndplr=1
diff --git a/vendor/gopkg.in/square/go-jose.v2/LICENSE b/vendor/gopkg.in/square/go-jose.v2/LICENSE
new file mode 100644
index 0000000..d645695
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/LICENSE
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/vendor/gopkg.in/square/go-jose.v2/README.md b/vendor/gopkg.in/square/go-jose.v2/README.md
new file mode 100644
index 0000000..1791bfa
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/README.md
@@ -0,0 +1,118 @@
+# Go JOSE 
+
+[![godoc](http://img.shields.io/badge/godoc-version_1-blue.svg?style=flat)](https://godoc.org/gopkg.in/square/go-jose.v1)
+[![godoc](http://img.shields.io/badge/godoc-version_2-blue.svg?style=flat)](https://godoc.org/gopkg.in/square/go-jose.v2)
+[![license](http://img.shields.io/badge/license-apache_2.0-blue.svg?style=flat)](https://raw.githubusercontent.com/square/go-jose/master/LICENSE)
+[![build](https://travis-ci.org/square/go-jose.svg?branch=v2)](https://travis-ci.org/square/go-jose)
+[![coverage](https://coveralls.io/repos/github/square/go-jose/badge.svg?branch=v2)](https://coveralls.io/r/square/go-jose)
+
+Package jose aims to provide an implementation of the Javascript Object Signing
+and Encryption set of standards. This includes support for JSON Web Encryption,
+JSON Web Signature, and JSON Web Token standards.
+
+**Disclaimer**: This library contains encryption software that is subject to
+the U.S. Export Administration Regulations. You may not export, re-export,
+transfer or download this code or any part of it in violation of any United
+States law, directive or regulation. In particular this software may not be
+exported or re-exported in any form or on any media to Iran, North Sudan,
+Syria, Cuba, or North Korea, or to denied persons or entities mentioned on any
+US maintained blocked list.
+
+## Overview
+
+The implementation follows the
+[JSON Web Encryption](http://dx.doi.org/10.17487/RFC7516) (RFC 7516),
+[JSON Web Signature](http://dx.doi.org/10.17487/RFC7515) (RFC 7515), and
+[JSON Web Token](http://dx.doi.org/10.17487/RFC7519) (RFC 7519).
+Tables of supported algorithms are shown below. The library supports both
+the compact and full serialization formats, and has optional support for
+multiple recipients. It also comes with a small command-line utility
+([`jose-util`](https://github.com/square/go-jose/tree/v2/jose-util))
+for dealing with JOSE messages in a shell.
+
+**Note**: We use a forked version of the `encoding/json` package from the Go
+standard library which uses case-sensitive matching for member names (instead
+of [case-insensitive matching](https://www.ietf.org/mail-archive/web/json/current/msg03763.html)).
+This is to avoid differences in interpretation of messages between go-jose and
+libraries in other languages.
+
+### Versions
+
+We use [gopkg.in](https://gopkg.in) for versioning.
+
+[Version 2](https://gopkg.in/square/go-jose.v2)
+([branch](https://github.com/square/go-jose/tree/v2),
+[doc](https://godoc.org/gopkg.in/square/go-jose.v2)) is the current version:
+
+    import "gopkg.in/square/go-jose.v2"
+
+The old `v1` branch ([go-jose.v1](https://gopkg.in/square/go-jose.v1)) will
+still receive backported bug fixes and security fixes, but otherwise
+development is frozen. All new feature development takes place on the `v2`
+branch. Version 2 also contains additional sub-packages such as the
+[jwt](https://godoc.org/gopkg.in/square/go-jose.v2/jwt) implementation
+contributed by [@shaxbee](https://github.com/shaxbee).
+
+### Supported algorithms
+
+See below for a table of supported algorithms. Algorithm identifiers match
+the names in the [JSON Web Algorithms](http://dx.doi.org/10.17487/RFC7518)
+standard where possible. The Godoc reference has a list of constants.
+
+ Key encryption             | Algorithm identifier(s)
+ :------------------------- | :------------------------------
+ RSA-PKCS#1v1.5             | RSA1_5
+ RSA-OAEP                   | RSA-OAEP, RSA-OAEP-256
+ AES key wrap               | A128KW, A192KW, A256KW
+ AES-GCM key wrap           | A128GCMKW, A192GCMKW, A256GCMKW
+ ECDH-ES + AES key wrap     | ECDH-ES+A128KW, ECDH-ES+A192KW, ECDH-ES+A256KW
+ ECDH-ES (direct)           | ECDH-ES<sup>1</sup>
+ Direct encryption          | dir<sup>1</sup>
+
+<sup>1. Not supported in multi-recipient mode</sup>
+
+ Signing / MAC              | Algorithm identifier(s)
+ :------------------------- | :------------------------------
+ RSASSA-PKCS#1v1.5          | RS256, RS384, RS512
+ RSASSA-PSS                 | PS256, PS384, PS512
+ HMAC                       | HS256, HS384, HS512
+ ECDSA                      | ES256, ES384, ES512
+ Ed25519                    | EdDSA<sup>2</sup>
+
+<sup>2. Only available in version 2 of the package</sup>
+
+ Content encryption         | Algorithm identifier(s)
+ :------------------------- | :------------------------------
+ AES-CBC+HMAC               | A128CBC-HS256, A192CBC-HS384, A256CBC-HS512
+ AES-GCM                    | A128GCM, A192GCM, A256GCM 
+
+ Compression                | Algorithm identifiers(s)
+ :------------------------- | -------------------------------
+ DEFLATE (RFC 1951)         | DEF
+
+### Supported key types
+
+See below for a table of supported key types. These are understood by the
+library, and can be passed to corresponding functions such as `NewEncrypter` or
+`NewSigner`. Each of these keys can also be wrapped in a JWK if desired, which
+allows attaching a key id.
+
+ Algorithm(s)               | Corresponding types
+ :------------------------- | -------------------------------
+ RSA                        | *[rsa.PublicKey](http://golang.org/pkg/crypto/rsa/#PublicKey), *[rsa.PrivateKey](http://golang.org/pkg/crypto/rsa/#PrivateKey)
+ ECDH, ECDSA                | *[ecdsa.PublicKey](http://golang.org/pkg/crypto/ecdsa/#PublicKey), *[ecdsa.PrivateKey](http://golang.org/pkg/crypto/ecdsa/#PrivateKey)
+ EdDSA<sup>1</sup>          | [ed25519.PublicKey](https://godoc.org/golang.org/x/crypto/ed25519#PublicKey), [ed25519.PrivateKey](https://godoc.org/golang.org/x/crypto/ed25519#PrivateKey)
+ AES, HMAC                  | []byte
+
+<sup>1. Only available in version 2 of the package</sup>
+
+## Examples
+
+[![godoc](http://img.shields.io/badge/godoc-version_1-blue.svg?style=flat)](https://godoc.org/gopkg.in/square/go-jose.v1)
+[![godoc](http://img.shields.io/badge/godoc-version_2-blue.svg?style=flat)](https://godoc.org/gopkg.in/square/go-jose.v2)
+
+Examples can be found in the Godoc
+reference for this package. The
+[`jose-util`](https://github.com/square/go-jose/tree/v2/jose-util)
+subdirectory also contains a small command-line utility which might be useful
+as an example.
diff --git a/vendor/gopkg.in/square/go-jose.v2/asymmetric.go b/vendor/gopkg.in/square/go-jose.v2/asymmetric.go
new file mode 100644
index 0000000..6793556
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/asymmetric.go
@@ -0,0 +1,592 @@
+/*-
+ * Copyright 2014 Square Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package jose
+
+import (
+	"crypto"
+	"crypto/aes"
+	"crypto/ecdsa"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/sha1"
+	"crypto/sha256"
+	"errors"
+	"fmt"
+	"math/big"
+
+	"golang.org/x/crypto/ed25519"
+	"gopkg.in/square/go-jose.v2/cipher"
+	"gopkg.in/square/go-jose.v2/json"
+)
+
+// A generic RSA-based encrypter/verifier
+type rsaEncrypterVerifier struct {
+	publicKey *rsa.PublicKey
+}
+
+// A generic RSA-based decrypter/signer
+type rsaDecrypterSigner struct {
+	privateKey *rsa.PrivateKey
+}
+
+// A generic EC-based encrypter/verifier
+type ecEncrypterVerifier struct {
+	publicKey *ecdsa.PublicKey
+}
+
+type edEncrypterVerifier struct {
+	publicKey ed25519.PublicKey
+}
+
+// A key generator for ECDH-ES
+type ecKeyGenerator struct {
+	size      int
+	algID     string
+	publicKey *ecdsa.PublicKey
+}
+
+// A generic EC-based decrypter/signer
+type ecDecrypterSigner struct {
+	privateKey *ecdsa.PrivateKey
+}
+
+type edDecrypterSigner struct {
+	privateKey ed25519.PrivateKey
+}
+
+// newRSARecipient creates recipientKeyInfo based on the given key.
+func newRSARecipient(keyAlg KeyAlgorithm, publicKey *rsa.PublicKey) (recipientKeyInfo, error) {
+	// Verify that key management algorithm is supported by this encrypter
+	switch keyAlg {
+	case RSA1_5, RSA_OAEP, RSA_OAEP_256:
+	default:
+		return recipientKeyInfo{}, ErrUnsupportedAlgorithm
+	}
+
+	if publicKey == nil {
+		return recipientKeyInfo{}, errors.New("invalid public key")
+	}
+
+	return recipientKeyInfo{
+		keyAlg: keyAlg,
+		keyEncrypter: &rsaEncrypterVerifier{
+			publicKey: publicKey,
+		},
+	}, nil
+}
+
+// newRSASigner creates a recipientSigInfo based on the given key.
+func newRSASigner(sigAlg SignatureAlgorithm, privateKey *rsa.PrivateKey) (recipientSigInfo, error) {
+	// Verify that key management algorithm is supported by this encrypter
+	switch sigAlg {
+	case RS256, RS384, RS512, PS256, PS384, PS512:
+	default:
+		return recipientSigInfo{}, ErrUnsupportedAlgorithm
+	}
+
+	if privateKey == nil {
+		return recipientSigInfo{}, errors.New("invalid private key")
+	}
+
+	return recipientSigInfo{
+		sigAlg: sigAlg,
+		publicKey: staticPublicKey(&JSONWebKey{
+			Key: privateKey.Public(),
+		}),
+		signer: &rsaDecrypterSigner{
+			privateKey: privateKey,
+		},
+	}, nil
+}
+
+func newEd25519Signer(sigAlg SignatureAlgorithm, privateKey ed25519.PrivateKey) (recipientSigInfo, error) {
+	if sigAlg != EdDSA {
+		return recipientSigInfo{}, ErrUnsupportedAlgorithm
+	}
+
+	if privateKey == nil {
+		return recipientSigInfo{}, errors.New("invalid private key")
+	}
+	return recipientSigInfo{
+		sigAlg: sigAlg,
+		publicKey: staticPublicKey(&JSONWebKey{
+			Key: privateKey.Public(),
+		}),
+		signer: &edDecrypterSigner{
+			privateKey: privateKey,
+		},
+	}, nil
+}
+
+// newECDHRecipient creates recipientKeyInfo based on the given key.
+func newECDHRecipient(keyAlg KeyAlgorithm, publicKey *ecdsa.PublicKey) (recipientKeyInfo, error) {
+	// Verify that key management algorithm is supported by this encrypter
+	switch keyAlg {
+	case ECDH_ES, ECDH_ES_A128KW, ECDH_ES_A192KW, ECDH_ES_A256KW:
+	default:
+		return recipientKeyInfo{}, ErrUnsupportedAlgorithm
+	}
+
+	if publicKey == nil || !publicKey.Curve.IsOnCurve(publicKey.X, publicKey.Y) {
+		return recipientKeyInfo{}, errors.New("invalid public key")
+	}
+
+	return recipientKeyInfo{
+		keyAlg: keyAlg,
+		keyEncrypter: &ecEncrypterVerifier{
+			publicKey: publicKey,
+		},
+	}, nil
+}
+
+// newECDSASigner creates a recipientSigInfo based on the given key.
+func newECDSASigner(sigAlg SignatureAlgorithm, privateKey *ecdsa.PrivateKey) (recipientSigInfo, error) {
+	// Verify that key management algorithm is supported by this encrypter
+	switch sigAlg {
+	case ES256, ES384, ES512:
+	default:
+		return recipientSigInfo{}, ErrUnsupportedAlgorithm
+	}
+
+	if privateKey == nil {
+		return recipientSigInfo{}, errors.New("invalid private key")
+	}
+
+	return recipientSigInfo{
+		sigAlg: sigAlg,
+		publicKey: staticPublicKey(&JSONWebKey{
+			Key: privateKey.Public(),
+		}),
+		signer: &ecDecrypterSigner{
+			privateKey: privateKey,
+		},
+	}, nil
+}
+
+// Encrypt the given payload and update the object.
+func (ctx rsaEncrypterVerifier) encryptKey(cek []byte, alg KeyAlgorithm) (recipientInfo, error) {
+	encryptedKey, err := ctx.encrypt(cek, alg)
+	if err != nil {
+		return recipientInfo{}, err
+	}
+
+	return recipientInfo{
+		encryptedKey: encryptedKey,
+		header:       &rawHeader{},
+	}, nil
+}
+
+// Encrypt the given payload. Based on the key encryption algorithm,
+// this will either use RSA-PKCS1v1.5 or RSA-OAEP (with SHA-1 or SHA-256).
+func (ctx rsaEncrypterVerifier) encrypt(cek []byte, alg KeyAlgorithm) ([]byte, error) {
+	switch alg {
+	case RSA1_5:
+		return rsa.EncryptPKCS1v15(RandReader, ctx.publicKey, cek)
+	case RSA_OAEP:
+		return rsa.EncryptOAEP(sha1.New(), RandReader, ctx.publicKey, cek, []byte{})
+	case RSA_OAEP_256:
+		return rsa.EncryptOAEP(sha256.New(), RandReader, ctx.publicKey, cek, []byte{})
+	}
+
+	return nil, ErrUnsupportedAlgorithm
+}
+
+// Decrypt the given payload and return the content encryption key.
+func (ctx rsaDecrypterSigner) decryptKey(headers rawHeader, recipient *recipientInfo, generator keyGenerator) ([]byte, error) {
+	return ctx.decrypt(recipient.encryptedKey, headers.getAlgorithm(), generator)
+}
+
+// Decrypt the given payload. Based on the key encryption algorithm,
+// this will either use RSA-PKCS1v1.5 or RSA-OAEP (with SHA-1 or SHA-256).
+func (ctx rsaDecrypterSigner) decrypt(jek []byte, alg KeyAlgorithm, generator keyGenerator) ([]byte, error) {
+	// Note: The random reader on decrypt operations is only used for blinding,
+	// so stubbing is meanlingless (hence the direct use of rand.Reader).
+	switch alg {
+	case RSA1_5:
+		defer func() {
+			// DecryptPKCS1v15SessionKey sometimes panics on an invalid payload
+			// because of an index out of bounds error, which we want to ignore.
+			// This has been fixed in Go 1.3.1 (released 2014/08/13), the recover()
+			// only exists for preventing crashes with unpatched versions.
+			// See: https://groups.google.com/forum/#!topic/golang-dev/7ihX6Y6kx9k
+			// See: https://code.google.com/p/go/source/detail?r=58ee390ff31602edb66af41ed10901ec95904d33
+			_ = recover()
+		}()
+
+		// Perform some input validation.
+		keyBytes := ctx.privateKey.PublicKey.N.BitLen() / 8
+		if keyBytes != len(jek) {
+			// Input size is incorrect, the encrypted payload should always match
+			// the size of the public modulus (e.g. using a 2048 bit key will
+			// produce 256 bytes of output). Reject this since it's invalid input.
+			return nil, ErrCryptoFailure
+		}
+
+		cek, _, err := generator.genKey()
+		if err != nil {
+			return nil, ErrCryptoFailure
+		}
+
+		// When decrypting an RSA-PKCS1v1.5 payload, we must take precautions to
+		// prevent chosen-ciphertext attacks as described in RFC 3218, "Preventing
+		// the Million Message Attack on Cryptographic Message Syntax". We are
+		// therefore deliberately ignoring errors here.
+		_ = rsa.DecryptPKCS1v15SessionKey(rand.Reader, ctx.privateKey, jek, cek)
+
+		return cek, nil
+	case RSA_OAEP:
+		// Use rand.Reader for RSA blinding
+		return rsa.DecryptOAEP(sha1.New(), rand.Reader, ctx.privateKey, jek, []byte{})
+	case RSA_OAEP_256:
+		// Use rand.Reader for RSA blinding
+		return rsa.DecryptOAEP(sha256.New(), rand.Reader, ctx.privateKey, jek, []byte{})
+	}
+
+	return nil, ErrUnsupportedAlgorithm
+}
+
+// Sign the given payload
+func (ctx rsaDecrypterSigner) signPayload(payload []byte, alg SignatureAlgorithm) (Signature, error) {
+	var hash crypto.Hash
+
+	switch alg {
+	case RS256, PS256:
+		hash = crypto.SHA256
+	case RS384, PS384:
+		hash = crypto.SHA384
+	case RS512, PS512:
+		hash = crypto.SHA512
+	default:
+		return Signature{}, ErrUnsupportedAlgorithm
+	}
+
+	hasher := hash.New()
+
+	// According to documentation, Write() on hash never fails
+	_, _ = hasher.Write(payload)
+	hashed := hasher.Sum(nil)
+
+	var out []byte
+	var err error
+
+	switch alg {
+	case RS256, RS384, RS512:
+		out, err = rsa.SignPKCS1v15(RandReader, ctx.privateKey, hash, hashed)
+	case PS256, PS384, PS512:
+		out, err = rsa.SignPSS(RandReader, ctx.privateKey, hash, hashed, &rsa.PSSOptions{
+			SaltLength: rsa.PSSSaltLengthAuto,
+		})
+	}
+
+	if err != nil {
+		return Signature{}, err
+	}
+
+	return Signature{
+		Signature: out,
+		protected: &rawHeader{},
+	}, nil
+}
+
+// Verify the given payload
+func (ctx rsaEncrypterVerifier) verifyPayload(payload []byte, signature []byte, alg SignatureAlgorithm) error {
+	var hash crypto.Hash
+
+	switch alg {
+	case RS256, PS256:
+		hash = crypto.SHA256
+	case RS384, PS384:
+		hash = crypto.SHA384
+	case RS512, PS512:
+		hash = crypto.SHA512
+	default:
+		return ErrUnsupportedAlgorithm
+	}
+
+	hasher := hash.New()
+
+	// According to documentation, Write() on hash never fails
+	_, _ = hasher.Write(payload)
+	hashed := hasher.Sum(nil)
+
+	switch alg {
+	case RS256, RS384, RS512:
+		return rsa.VerifyPKCS1v15(ctx.publicKey, hash, hashed, signature)
+	case PS256, PS384, PS512:
+		return rsa.VerifyPSS(ctx.publicKey, hash, hashed, signature, nil)
+	}
+
+	return ErrUnsupportedAlgorithm
+}
+
+// Encrypt the given payload and update the object.
+func (ctx ecEncrypterVerifier) encryptKey(cek []byte, alg KeyAlgorithm) (recipientInfo, error) {
+	switch alg {
+	case ECDH_ES:
+		// ECDH-ES mode doesn't wrap a key, the shared secret is used directly as the key.
+		return recipientInfo{
+			header: &rawHeader{},
+		}, nil
+	case ECDH_ES_A128KW, ECDH_ES_A192KW, ECDH_ES_A256KW:
+	default:
+		return recipientInfo{}, ErrUnsupportedAlgorithm
+	}
+
+	generator := ecKeyGenerator{
+		algID:     string(alg),
+		publicKey: ctx.publicKey,
+	}
+
+	switch alg {
+	case ECDH_ES_A128KW:
+		generator.size = 16
+	case ECDH_ES_A192KW:
+		generator.size = 24
+	case ECDH_ES_A256KW:
+		generator.size = 32
+	}
+
+	kek, header, err := generator.genKey()
+	if err != nil {
+		return recipientInfo{}, err
+	}
+
+	block, err := aes.NewCipher(kek)
+	if err != nil {
+		return recipientInfo{}, err
+	}
+
+	jek, err := josecipher.KeyWrap(block, cek)
+	if err != nil {
+		return recipientInfo{}, err
+	}
+
+	return recipientInfo{
+		encryptedKey: jek,
+		header:       &header,
+	}, nil
+}
+
+// Get key size for EC key generator
+func (ctx ecKeyGenerator) keySize() int {
+	return ctx.size
+}
+
+// Get a content encryption key for ECDH-ES
+func (ctx ecKeyGenerator) genKey() ([]byte, rawHeader, error) {
+	priv, err := ecdsa.GenerateKey(ctx.publicKey.Curve, RandReader)
+	if err != nil {
+		return nil, rawHeader{}, err
+	}
+
+	out := josecipher.DeriveECDHES(ctx.algID, []byte{}, []byte{}, priv, ctx.publicKey, ctx.size)
+
+	b, err := json.Marshal(&JSONWebKey{
+		Key: &priv.PublicKey,
+	})
+	if err != nil {
+		return nil, nil, err
+	}
+
+	headers := rawHeader{
+		headerEPK: makeRawMessage(b),
+	}
+
+	return out, headers, nil
+}
+
+// Decrypt the given payload and return the content encryption key.
+func (ctx ecDecrypterSigner) decryptKey(headers rawHeader, recipient *recipientInfo, generator keyGenerator) ([]byte, error) {
+	epk, err := headers.getEPK()
+	if err != nil {
+		return nil, errors.New("square/go-jose: invalid epk header")
+	}
+	if epk == nil {
+		return nil, errors.New("square/go-jose: missing epk header")
+	}
+
+	publicKey, ok := epk.Key.(*ecdsa.PublicKey)
+	if publicKey == nil || !ok {
+		return nil, errors.New("square/go-jose: invalid epk header")
+	}
+
+	if !ctx.privateKey.Curve.IsOnCurve(publicKey.X, publicKey.Y) {
+		return nil, errors.New("square/go-jose: invalid public key in epk header")
+	}
+
+	apuData, err := headers.getAPU()
+	if err != nil {
+		return nil, errors.New("square/go-jose: invalid apu header")
+	}
+	apvData, err := headers.getAPV()
+	if err != nil {
+		return nil, errors.New("square/go-jose: invalid apv header")
+	}
+
+	deriveKey := func(algID string, size int) []byte {
+		return josecipher.DeriveECDHES(algID, apuData.bytes(), apvData.bytes(), ctx.privateKey, publicKey, size)
+	}
+
+	var keySize int
+
+	algorithm := headers.getAlgorithm()
+	switch algorithm {
+	case ECDH_ES:
+		// ECDH-ES uses direct key agreement, no key unwrapping necessary.
+		return deriveKey(string(headers.getEncryption()), generator.keySize()), nil
+	case ECDH_ES_A128KW:
+		keySize = 16
+	case ECDH_ES_A192KW:
+		keySize = 24
+	case ECDH_ES_A256KW:
+		keySize = 32
+	default:
+		return nil, ErrUnsupportedAlgorithm
+	}
+
+	key := deriveKey(string(algorithm), keySize)
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, err
+	}
+
+	return josecipher.KeyUnwrap(block, recipient.encryptedKey)
+}
+
+func (ctx edDecrypterSigner) signPayload(payload []byte, alg SignatureAlgorithm) (Signature, error) {
+	if alg != EdDSA {
+		return Signature{}, ErrUnsupportedAlgorithm
+	}
+
+	sig, err := ctx.privateKey.Sign(RandReader, payload, crypto.Hash(0))
+	if err != nil {
+		return Signature{}, err
+	}
+
+	return Signature{
+		Signature: sig,
+		protected: &rawHeader{},
+	}, nil
+}
+
+func (ctx edEncrypterVerifier) verifyPayload(payload []byte, signature []byte, alg SignatureAlgorithm) error {
+	if alg != EdDSA {
+		return ErrUnsupportedAlgorithm
+	}
+	ok := ed25519.Verify(ctx.publicKey, payload, signature)
+	if !ok {
+		return errors.New("square/go-jose: ed25519 signature failed to verify")
+	}
+	return nil
+}
+
+// Sign the given payload
+func (ctx ecDecrypterSigner) signPayload(payload []byte, alg SignatureAlgorithm) (Signature, error) {
+	var expectedBitSize int
+	var hash crypto.Hash
+
+	switch alg {
+	case ES256:
+		expectedBitSize = 256
+		hash = crypto.SHA256
+	case ES384:
+		expectedBitSize = 384
+		hash = crypto.SHA384
+	case ES512:
+		expectedBitSize = 521
+		hash = crypto.SHA512
+	}
+
+	curveBits := ctx.privateKey.Curve.Params().BitSize
+	if expectedBitSize != curveBits {
+		return Signature{}, fmt.Errorf("square/go-jose: expected %d bit key, got %d bits instead", expectedBitSize, curveBits)
+	}
+
+	hasher := hash.New()
+
+	// According to documentation, Write() on hash never fails
+	_, _ = hasher.Write(payload)
+	hashed := hasher.Sum(nil)
+
+	r, s, err := ecdsa.Sign(RandReader, ctx.privateKey, hashed)
+	if err != nil {
+		return Signature{}, err
+	}
+
+	keyBytes := curveBits / 8
+	if curveBits%8 > 0 {
+		keyBytes++
+	}
+
+	// We serialize the outputs (r and s) into big-endian byte arrays and pad
+	// them with zeros on the left to make sure the sizes work out. Both arrays
+	// must be keyBytes long, and the output must be 2*keyBytes long.
+	rBytes := r.Bytes()
+	rBytesPadded := make([]byte, keyBytes)
+	copy(rBytesPadded[keyBytes-len(rBytes):], rBytes)
+
+	sBytes := s.Bytes()
+	sBytesPadded := make([]byte, keyBytes)
+	copy(sBytesPadded[keyBytes-len(sBytes):], sBytes)
+
+	out := append(rBytesPadded, sBytesPadded...)
+
+	return Signature{
+		Signature: out,
+		protected: &rawHeader{},
+	}, nil
+}
+
+// Verify the given payload
+func (ctx ecEncrypterVerifier) verifyPayload(payload []byte, signature []byte, alg SignatureAlgorithm) error {
+	var keySize int
+	var hash crypto.Hash
+
+	switch alg {
+	case ES256:
+		keySize = 32
+		hash = crypto.SHA256
+	case ES384:
+		keySize = 48
+		hash = crypto.SHA384
+	case ES512:
+		keySize = 66
+		hash = crypto.SHA512
+	default:
+		return ErrUnsupportedAlgorithm
+	}
+
+	if len(signature) != 2*keySize {
+		return fmt.Errorf("square/go-jose: invalid signature size, have %d bytes, wanted %d", len(signature), 2*keySize)
+	}
+
+	hasher := hash.New()
+
+	// According to documentation, Write() on hash never fails
+	_, _ = hasher.Write(payload)
+	hashed := hasher.Sum(nil)
+
+	r := big.NewInt(0).SetBytes(signature[:keySize])
+	s := big.NewInt(0).SetBytes(signature[keySize:])
+
+	match := ecdsa.Verify(ctx.publicKey, hashed, r, s)
+	if !match {
+		return errors.New("square/go-jose: ecdsa signature failed to verify")
+	}
+
+	return nil
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/asymmetric_test.go b/vendor/gopkg.in/square/go-jose.v2/asymmetric_test.go
new file mode 100644
index 0000000..eb22b1d
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/asymmetric_test.go
@@ -0,0 +1,388 @@
+/*-
+ * Copyright 2014 Square Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package jose
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/rsa"
+	"errors"
+	"io"
+	"testing"
+)
+
+func TestEd25519(t *testing.T) {
+	_, err := newEd25519Signer("XYZ", nil)
+	if err != ErrUnsupportedAlgorithm {
+		t.Error("should return error on invalid algorithm")
+	}
+
+	enc := new(edEncrypterVerifier)
+	enc.publicKey = ed25519PublicKey
+	err = enc.verifyPayload([]byte{}, []byte{}, "XYZ")
+	if err != ErrUnsupportedAlgorithm {
+		t.Error("should return error on invalid algorithm")
+	}
+
+	dec := new(edDecrypterSigner)
+	dec.privateKey = ed25519PrivateKey
+	_, err = dec.signPayload([]byte{}, "XYZ")
+	if err != ErrUnsupportedAlgorithm {
+		t.Error("should return error on invalid algorithm")
+	}
+
+	sig, err := dec.signPayload([]byte("This is a test"), "EdDSA")
+	if err != nil {
+		t.Error("should not error trying to sign payload")
+	}
+	if sig.Signature == nil {
+		t.Error("Check the signature")
+	}
+	err = enc.verifyPayload([]byte("This is a test"), sig.Signature, "EdDSA")
+	if err != nil {
+		t.Error("should not error trying to verify payload")
+	}
+
+	err = enc.verifyPayload([]byte("This is test number 2"), sig.Signature, "EdDSA")
+	if err == nil {
+		t.Error("should not error trying to verify payload")
+	}
+}
+
+func TestInvalidAlgorithmsRSA(t *testing.T) {
+	_, err := newRSARecipient("XYZ", nil)
+	if err != ErrUnsupportedAlgorithm {
+		t.Error("should return error on invalid algorithm")
+	}
+
+	_, err = newRSASigner("XYZ", nil)
+	if err != ErrUnsupportedAlgorithm {
+		t.Error("should return error on invalid algorithm")
+	}
+
+	enc := new(rsaEncrypterVerifier)
+	enc.publicKey = &rsaTestKey.PublicKey
+	_, err = enc.encryptKey([]byte{}, "XYZ")
+	if err != ErrUnsupportedAlgorithm {
+		t.Error("should return error on invalid algorithm")
+	}
+
+	err = enc.verifyPayload([]byte{}, []byte{}, "XYZ")
+	if err != ErrUnsupportedAlgorithm {
+		t.Error("should return error on invalid algorithm")
+	}
+
+	dec := new(rsaDecrypterSigner)
+	dec.privateKey = rsaTestKey
+	_, err = dec.decrypt(make([]byte, 256), "XYZ", randomKeyGenerator{size: 16})
+	if err != ErrUnsupportedAlgorithm {
+		t.Error("should return error on invalid algorithm")
+	}
+
+	_, err = dec.signPayload([]byte{}, "XYZ")
+	if err != ErrUnsupportedAlgorithm {
+		t.Error("should return error on invalid algorithm")
+	}
+}
+
+type failingKeyGenerator struct{}
+
+func (ctx failingKeyGenerator) keySize() int {
+	return 0
+}
+
+func (ctx failingKeyGenerator) genKey() ([]byte, rawHeader, error) {
+	return nil, rawHeader{}, errors.New("failed to generate key")
+}
+
+func TestPKCSKeyGeneratorFailure(t *testing.T) {
+	dec := new(rsaDecrypterSigner)
+	dec.privateKey = rsaTestKey
+	generator := failingKeyGenerator{}
+	_, err := dec.decrypt(make([]byte, 256), RSA1_5, generator)
+	if err != ErrCryptoFailure {
+		t.Error("should return error on invalid algorithm")
+	}
+}
+
+func TestInvalidAlgorithmsEC(t *testing.T) {
+	_, err := newECDHRecipient("XYZ", nil)
+	if err != ErrUnsupportedAlgorithm {
+		t.Error("should return error on invalid algorithm")
+	}
+
+	_, err = newECDSASigner("XYZ", nil)
+	if err != ErrUnsupportedAlgorithm {
+		t.Error("should return error on invalid algorithm")
+	}
+
+	enc := new(ecEncrypterVerifier)
+	enc.publicKey = &ecTestKey256.PublicKey
+	_, err = enc.encryptKey([]byte{}, "XYZ")
+	if err != ErrUnsupportedAlgorithm {
+		t.Error("should return error on invalid algorithm")
+	}
+}
+
+func TestInvalidECKeyGen(t *testing.T) {
+	gen := ecKeyGenerator{
+		size:      16,
+		algID:     "A128GCM",
+		publicKey: &ecTestKey256.PublicKey,
+	}
+
+	if gen.keySize() != 16 {
+		t.Error("ec key generator reported incorrect key size")
+	}
+
+	_, _, err := gen.genKey()
+	if err != nil {
+		t.Error("ec key generator failed to generate key", err)
+	}
+}
+
+func TestInvalidECDecrypt(t *testing.T) {
+	dec := ecDecrypterSigner{
+		privateKey: ecTestKey256,
+	}
+
+	generator := randomKeyGenerator{size: 16}
+
+	// Missing epk header
+	headers := rawHeader{}
+	headers.set(headerAlgorithm, ECDH_ES)
+
+	_, err := dec.decryptKey(headers, nil, generator)
+	if err == nil {
+		t.Error("ec decrypter accepted object with missing epk header")
+	}
+
+	// Invalid epk header
+	headers.set(headerEPK, &JSONWebKey{})
+
+	_, err = dec.decryptKey(headers, nil, generator)
+	if err == nil {
+		t.Error("ec decrypter accepted object with invalid epk header")
+	}
+}
+
+func TestDecryptWithIncorrectSize(t *testing.T) {
+	priv, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		t.Error(err)
+		return
+	}
+
+	dec := new(rsaDecrypterSigner)
+	dec.privateKey = priv
+	aes := newAESGCM(16)
+
+	keygen := randomKeyGenerator{
+		size: aes.keySize(),
+	}
+
+	payload := make([]byte, 254)
+	_, err = dec.decrypt(payload, RSA1_5, keygen)
+	if err == nil {
+		t.Error("Invalid payload size should return error")
+	}
+
+	payload = make([]byte, 257)
+	_, err = dec.decrypt(payload, RSA1_5, keygen)
+	if err == nil {
+		t.Error("Invalid payload size should return error")
+	}
+}
+
+func TestPKCSDecryptNeverFails(t *testing.T) {
+	// We don't want RSA-PKCS1 v1.5 decryption to ever fail, in order to prevent
+	// side-channel timing attacks (Bleichenbacher attack in particular).
+	priv, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		t.Error(err)
+		return
+	}
+
+	dec := new(rsaDecrypterSigner)
+	dec.privateKey = priv
+	aes := newAESGCM(16)
+
+	keygen := randomKeyGenerator{
+		size: aes.keySize(),
+	}
+
+	for i := 1; i < 50; i++ {
+		payload := make([]byte, 256)
+		_, err := io.ReadFull(rand.Reader, payload)
+		if err != nil {
+			t.Error("Unable to get random data:", err)
+			return
+		}
+		_, err = dec.decrypt(payload, RSA1_5, keygen)
+		if err != nil {
+			t.Error("PKCS1v1.5 decrypt should never fail:", err)
+			return
+		}
+	}
+}
+
+func BenchmarkPKCSDecryptWithValidPayloads(b *testing.B) {
+	priv, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		panic(err)
+	}
+
+	enc := new(rsaEncrypterVerifier)
+	enc.publicKey = &priv.PublicKey
+	dec := new(rsaDecrypterSigner)
+	dec.privateKey = priv
+	aes := newAESGCM(32)
+
+	b.StopTimer()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		plaintext := make([]byte, 32)
+		_, err = io.ReadFull(rand.Reader, plaintext)
+		if err != nil {
+			panic(err)
+		}
+
+		ciphertext, err := enc.encrypt(plaintext, RSA1_5)
+		if err != nil {
+			panic(err)
+		}
+
+		keygen := randomKeyGenerator{
+			size: aes.keySize(),
+		}
+
+		b.StartTimer()
+		_, err = dec.decrypt(ciphertext, RSA1_5, keygen)
+		b.StopTimer()
+		if err != nil {
+			panic(err)
+		}
+	}
+}
+
+func BenchmarkPKCSDecryptWithInvalidPayloads(b *testing.B) {
+	priv, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		panic(err)
+	}
+
+	enc := new(rsaEncrypterVerifier)
+	enc.publicKey = &priv.PublicKey
+	dec := new(rsaDecrypterSigner)
+	dec.privateKey = priv
+	aes := newAESGCM(16)
+
+	keygen := randomKeyGenerator{
+		size: aes.keySize(),
+	}
+
+	b.StopTimer()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		plaintext := make([]byte, 16)
+		_, err = io.ReadFull(rand.Reader, plaintext)
+		if err != nil {
+			panic(err)
+		}
+
+		ciphertext, err := enc.encrypt(plaintext, RSA1_5)
+		if err != nil {
+			panic(err)
+		}
+
+		// Do some simple scrambling
+		ciphertext[128] ^= 0xFF
+
+		b.StartTimer()
+		_, err = dec.decrypt(ciphertext, RSA1_5, keygen)
+		b.StopTimer()
+		if err != nil {
+			panic(err)
+		}
+	}
+}
+
+func TestInvalidEllipticCurve(t *testing.T) {
+	signer256 := ecDecrypterSigner{privateKey: ecTestKey256}
+	signer384 := ecDecrypterSigner{privateKey: ecTestKey384}
+	signer521 := ecDecrypterSigner{privateKey: ecTestKey521}
+
+	_, err := signer256.signPayload([]byte{}, ES384)
+	if err == nil {
+		t.Error("should not generate ES384 signature with P-256 key")
+	}
+	_, err = signer256.signPayload([]byte{}, ES512)
+	if err == nil {
+		t.Error("should not generate ES512 signature with P-256 key")
+	}
+	_, err = signer384.signPayload([]byte{}, ES256)
+	if err == nil {
+		t.Error("should not generate ES256 signature with P-384 key")
+	}
+	_, err = signer384.signPayload([]byte{}, ES512)
+	if err == nil {
+		t.Error("should not generate ES512 signature with P-384 key")
+	}
+	_, err = signer521.signPayload([]byte{}, ES256)
+	if err == nil {
+		t.Error("should not generate ES256 signature with P-521 key")
+	}
+	_, err = signer521.signPayload([]byte{}, ES384)
+	if err == nil {
+		t.Error("should not generate ES384 signature with P-521 key")
+	}
+}
+
+func estInvalidECPublicKey(t *testing.T) {
+	// Invalid key
+	invalid := &ecdsa.PrivateKey{
+		PublicKey: ecdsa.PublicKey{
+			Curve: elliptic.P256(),
+			X:     fromBase64Int("MTEx"),
+			Y:     fromBase64Int("MTEx"),
+		},
+		D: fromBase64Int("0_NxaRPUMQoAJt50Gz8YiTr8gRTwyEaCumd-MToTmIo"),
+	}
+
+	headers := rawHeader{}
+	headers.set(headerAlgorithm, ECDH_ES)
+	headers.set(headerEPK, &JSONWebKey{
+		Key: &invalid.PublicKey,
+	})
+
+	dec := ecDecrypterSigner{
+		privateKey: ecTestKey256,
+	}
+
+	_, err := dec.decryptKey(headers, nil, randomKeyGenerator{size: 16})
+	if err == nil {
+		t.Fatal("decrypter accepted JWS with invalid ECDH public key")
+	}
+}
+
+func TestInvalidAlgorithmEC(t *testing.T) {
+	err := ecEncrypterVerifier{publicKey: &ecTestKey256.PublicKey}.verifyPayload([]byte{}, []byte{}, "XYZ")
+	if err != ErrUnsupportedAlgorithm {
+		t.Fatal("should not accept invalid/unsupported algorithm")
+	}
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/cipher/cbc_hmac.go b/vendor/gopkg.in/square/go-jose.v2/cipher/cbc_hmac.go
new file mode 100644
index 0000000..126b85c
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/cipher/cbc_hmac.go
@@ -0,0 +1,196 @@
+/*-
+ * Copyright 2014 Square Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package josecipher
+
+import (
+	"bytes"
+	"crypto/cipher"
+	"crypto/hmac"
+	"crypto/sha256"
+	"crypto/sha512"
+	"crypto/subtle"
+	"encoding/binary"
+	"errors"
+	"hash"
+)
+
+const (
+	nonceBytes = 16
+)
+
+// NewCBCHMAC instantiates a new AEAD based on CBC+HMAC.
+func NewCBCHMAC(key []byte, newBlockCipher func([]byte) (cipher.Block, error)) (cipher.AEAD, error) {
+	keySize := len(key) / 2
+	integrityKey := key[:keySize]
+	encryptionKey := key[keySize:]
+
+	blockCipher, err := newBlockCipher(encryptionKey)
+	if err != nil {
+		return nil, err
+	}
+
+	var hash func() hash.Hash
+	switch keySize {
+	case 16:
+		hash = sha256.New
+	case 24:
+		hash = sha512.New384
+	case 32:
+		hash = sha512.New
+	}
+
+	return &cbcAEAD{
+		hash:         hash,
+		blockCipher:  blockCipher,
+		authtagBytes: keySize,
+		integrityKey: integrityKey,
+	}, nil
+}
+
+// An AEAD based on CBC+HMAC
+type cbcAEAD struct {
+	hash         func() hash.Hash
+	authtagBytes int
+	integrityKey []byte
+	blockCipher  cipher.Block
+}
+
+func (ctx *cbcAEAD) NonceSize() int {
+	return nonceBytes
+}
+
+func (ctx *cbcAEAD) Overhead() int {
+	// Maximum overhead is block size (for padding) plus auth tag length, where
+	// the length of the auth tag is equivalent to the key size.
+	return ctx.blockCipher.BlockSize() + ctx.authtagBytes
+}
+
+// Seal encrypts and authenticates the plaintext.
+func (ctx *cbcAEAD) Seal(dst, nonce, plaintext, data []byte) []byte {
+	// Output buffer -- must take care not to mangle plaintext input.
+	ciphertext := make([]byte, uint64(len(plaintext))+uint64(ctx.Overhead()))[:len(plaintext)]
+	copy(ciphertext, plaintext)
+	ciphertext = padBuffer(ciphertext, ctx.blockCipher.BlockSize())
+
+	cbc := cipher.NewCBCEncrypter(ctx.blockCipher, nonce)
+
+	cbc.CryptBlocks(ciphertext, ciphertext)
+	authtag := ctx.computeAuthTag(data, nonce, ciphertext)
+
+	ret, out := resize(dst, uint64(len(dst))+uint64(len(ciphertext))+uint64(len(authtag)))
+	copy(out, ciphertext)
+	copy(out[len(ciphertext):], authtag)
+
+	return ret
+}
+
+// Open decrypts and authenticates the ciphertext.
+func (ctx *cbcAEAD) Open(dst, nonce, ciphertext, data []byte) ([]byte, error) {
+	if len(ciphertext) < ctx.authtagBytes {
+		return nil, errors.New("square/go-jose: invalid ciphertext (too short)")
+	}
+
+	offset := len(ciphertext) - ctx.authtagBytes
+	expectedTag := ctx.computeAuthTag(data, nonce, ciphertext[:offset])
+	match := subtle.ConstantTimeCompare(expectedTag, ciphertext[offset:])
+	if match != 1 {
+		return nil, errors.New("square/go-jose: invalid ciphertext (auth tag mismatch)")
+	}
+
+	cbc := cipher.NewCBCDecrypter(ctx.blockCipher, nonce)
+
+	// Make copy of ciphertext buffer, don't want to modify in place
+	buffer := append([]byte{}, []byte(ciphertext[:offset])...)
+
+	if len(buffer)%ctx.blockCipher.BlockSize() > 0 {
+		return nil, errors.New("square/go-jose: invalid ciphertext (invalid length)")
+	}
+
+	cbc.CryptBlocks(buffer, buffer)
+
+	// Remove padding
+	plaintext, err := unpadBuffer(buffer, ctx.blockCipher.BlockSize())
+	if err != nil {
+		return nil, err
+	}
+
+	ret, out := resize(dst, uint64(len(dst))+uint64(len(plaintext)))
+	copy(out, plaintext)
+
+	return ret, nil
+}
+
+// Compute an authentication tag
+func (ctx *cbcAEAD) computeAuthTag(aad, nonce, ciphertext []byte) []byte {
+	buffer := make([]byte, uint64(len(aad))+uint64(len(nonce))+uint64(len(ciphertext))+8)
+	n := 0
+	n += copy(buffer, aad)
+	n += copy(buffer[n:], nonce)
+	n += copy(buffer[n:], ciphertext)
+	binary.BigEndian.PutUint64(buffer[n:], uint64(len(aad))*8)
+
+	// According to documentation, Write() on hash.Hash never fails.
+	hmac := hmac.New(ctx.hash, ctx.integrityKey)
+	_, _ = hmac.Write(buffer)
+
+	return hmac.Sum(nil)[:ctx.authtagBytes]
+}
+
+// resize ensures the the given slice has a capacity of at least n bytes.
+// If the capacity of the slice is less than n, a new slice is allocated
+// and the existing data will be copied.
+func resize(in []byte, n uint64) (head, tail []byte) {
+	if uint64(cap(in)) >= n {
+		head = in[:n]
+	} else {
+		head = make([]byte, n)
+		copy(head, in)
+	}
+
+	tail = head[len(in):]
+	return
+}
+
+// Apply padding
+func padBuffer(buffer []byte, blockSize int) []byte {
+	missing := blockSize - (len(buffer) % blockSize)
+	ret, out := resize(buffer, uint64(len(buffer))+uint64(missing))
+	padding := bytes.Repeat([]byte{byte(missing)}, missing)
+	copy(out, padding)
+	return ret
+}
+
+// Remove padding
+func unpadBuffer(buffer []byte, blockSize int) ([]byte, error) {
+	if len(buffer)%blockSize != 0 {
+		return nil, errors.New("square/go-jose: invalid padding")
+	}
+
+	last := buffer[len(buffer)-1]
+	count := int(last)
+
+	if count == 0 || count > blockSize || count > len(buffer) {
+		return nil, errors.New("square/go-jose: invalid padding")
+	}
+
+	padding := bytes.Repeat([]byte{last}, count)
+	if !bytes.HasSuffix(buffer, padding) {
+		return nil, errors.New("square/go-jose: invalid padding")
+	}
+
+	return buffer[:len(buffer)-count], nil
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/cipher/cbc_hmac_test.go b/vendor/gopkg.in/square/go-jose.v2/cipher/cbc_hmac_test.go
new file mode 100644
index 0000000..40bcb20
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/cipher/cbc_hmac_test.go
@@ -0,0 +1,498 @@
+/*-
+ * Copyright 2014 Square Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package josecipher
+
+import (
+	"bytes"
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/rand"
+	"io"
+	"strings"
+	"testing"
+)
+
+func TestInvalidInputs(t *testing.T) {
+	key := []byte{
+		0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15,
+		0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15,
+	}
+
+	nonce := []byte{
+		92, 80, 104, 49, 133, 25, 161, 215, 173, 101, 219, 211, 136, 91, 210, 145}
+
+	aead, _ := NewCBCHMAC(key, aes.NewCipher)
+	ciphertext := aead.Seal(nil, nonce, []byte("plaintext"), []byte("aad"))
+
+	// Changed AAD, must fail
+	_, err := aead.Open(nil, nonce, ciphertext, []byte("INVALID"))
+	if err == nil {
+		t.Error("must detect invalid aad")
+	}
+
+	// Empty ciphertext, must fail
+	_, err = aead.Open(nil, nonce, []byte{}, []byte("aad"))
+	if err == nil {
+		t.Error("must detect invalid/empty ciphertext")
+	}
+
+	// Corrupt ciphertext, must fail
+	corrupt := make([]byte, len(ciphertext))
+	copy(corrupt, ciphertext)
+	corrupt[0] ^= 0xFF
+
+	_, err = aead.Open(nil, nonce, corrupt, []byte("aad"))
+	if err == nil {
+		t.Error("must detect corrupt ciphertext")
+	}
+
+	// Corrupt authtag, must fail
+	copy(corrupt, ciphertext)
+	corrupt[len(ciphertext)-1] ^= 0xFF
+
+	_, err = aead.Open(nil, nonce, corrupt, []byte("aad"))
+	if err == nil {
+		t.Error("must detect corrupt authtag")
+	}
+
+	// Truncated data, must fail
+	_, err = aead.Open(nil, nonce, ciphertext[:10], []byte("aad"))
+	if err == nil {
+		t.Error("must detect corrupt authtag")
+	}
+}
+
+func TestVectorsAESCBC128(t *testing.T) {
+	// Source: http://tools.ietf.org/html/draft-ietf-jose-json-web-encryption-29#appendix-A.2
+	plaintext := []byte{
+		76, 105, 118, 101, 32, 108, 111, 110, 103, 32, 97, 110, 100, 32,
+		112, 114, 111, 115, 112, 101, 114, 46}
+
+	aad := []byte{
+		101, 121, 74, 104, 98, 71, 99, 105, 79, 105, 74, 83, 85, 48, 69,
+		120, 88, 122, 85, 105, 76, 67, 74, 108, 98, 109, 77, 105, 79, 105,
+		74, 66, 77, 84, 73, 52, 81, 48, 74, 68, 76, 85, 104, 84, 77, 106, 85,
+		50, 73, 110, 48}
+
+	expectedCiphertext := []byte{
+		40, 57, 83, 181, 119, 33, 133, 148, 198, 185, 243, 24, 152, 230, 6,
+		75, 129, 223, 127, 19, 210, 82, 183, 230, 168, 33, 215, 104, 143,
+		112, 56, 102}
+
+	expectedAuthtag := []byte{
+		246, 17, 244, 190, 4, 95, 98, 3, 231, 0, 115, 157, 242, 203, 100,
+		191}
+
+	key := []byte{
+		4, 211, 31, 197, 84, 157, 252, 254, 11, 100, 157, 250, 63, 170, 106, 206,
+		107, 124, 212, 45, 111, 107, 9, 219, 200, 177, 0, 240, 143, 156, 44, 207}
+
+	nonce := []byte{
+		3, 22, 60, 12, 43, 67, 104, 105, 108, 108, 105, 99, 111, 116, 104, 101}
+
+	enc, err := NewCBCHMAC(key, aes.NewCipher)
+	out := enc.Seal(nil, nonce, plaintext, aad)
+	if err != nil {
+		t.Error("Unable to encrypt:", err)
+		return
+	}
+
+	if bytes.Compare(out[:len(out)-16], expectedCiphertext) != 0 {
+		t.Error("Ciphertext did not match")
+	}
+	if bytes.Compare(out[len(out)-16:], expectedAuthtag) != 0 {
+		t.Error("Auth tag did not match")
+	}
+}
+
+func TestVectorsAESCBC256(t *testing.T) {
+	// Source: https://tools.ietf.org/html/draft-mcgrew-aead-aes-cbc-hmac-sha2-05#section-5.4
+	plaintext := []byte{
+		0x41, 0x20, 0x63, 0x69, 0x70, 0x68, 0x65, 0x72, 0x20, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x20,
+		0x6d, 0x75, 0x73, 0x74, 0x20, 0x6e, 0x6f, 0x74, 0x20, 0x62, 0x65, 0x20, 0x72, 0x65, 0x71, 0x75,
+		0x69, 0x72, 0x65, 0x64, 0x20, 0x74, 0x6f, 0x20, 0x62, 0x65, 0x20, 0x73, 0x65, 0x63, 0x72, 0x65,
+		0x74, 0x2c, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x69, 0x74, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62,
+		0x65, 0x20, 0x61, 0x62, 0x6c, 0x65, 0x20, 0x74, 0x6f, 0x20, 0x66, 0x61, 0x6c, 0x6c, 0x20, 0x69,
+		0x6e, 0x74, 0x6f, 0x20, 0x74, 0x68, 0x65, 0x20, 0x68, 0x61, 0x6e, 0x64, 0x73, 0x20, 0x6f, 0x66,
+		0x20, 0x74, 0x68, 0x65, 0x20, 0x65, 0x6e, 0x65, 0x6d, 0x79, 0x20, 0x77, 0x69, 0x74, 0x68, 0x6f,
+		0x75, 0x74, 0x20, 0x69, 0x6e, 0x63, 0x6f, 0x6e, 0x76, 0x65, 0x6e, 0x69, 0x65, 0x6e, 0x63, 0x65}
+
+	aad := []byte{
+		0x54, 0x68, 0x65, 0x20, 0x73, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x20, 0x70, 0x72, 0x69, 0x6e, 0x63,
+		0x69, 0x70, 0x6c, 0x65, 0x20, 0x6f, 0x66, 0x20, 0x41, 0x75, 0x67, 0x75, 0x73, 0x74, 0x65, 0x20,
+		0x4b, 0x65, 0x72, 0x63, 0x6b, 0x68, 0x6f, 0x66, 0x66, 0x73}
+
+	expectedCiphertext := []byte{
+		0x4a, 0xff, 0xaa, 0xad, 0xb7, 0x8c, 0x31, 0xc5, 0xda, 0x4b, 0x1b, 0x59, 0x0d, 0x10, 0xff, 0xbd,
+		0x3d, 0xd8, 0xd5, 0xd3, 0x02, 0x42, 0x35, 0x26, 0x91, 0x2d, 0xa0, 0x37, 0xec, 0xbc, 0xc7, 0xbd,
+		0x82, 0x2c, 0x30, 0x1d, 0xd6, 0x7c, 0x37, 0x3b, 0xcc, 0xb5, 0x84, 0xad, 0x3e, 0x92, 0x79, 0xc2,
+		0xe6, 0xd1, 0x2a, 0x13, 0x74, 0xb7, 0x7f, 0x07, 0x75, 0x53, 0xdf, 0x82, 0x94, 0x10, 0x44, 0x6b,
+		0x36, 0xeb, 0xd9, 0x70, 0x66, 0x29, 0x6a, 0xe6, 0x42, 0x7e, 0xa7, 0x5c, 0x2e, 0x08, 0x46, 0xa1,
+		0x1a, 0x09, 0xcc, 0xf5, 0x37, 0x0d, 0xc8, 0x0b, 0xfe, 0xcb, 0xad, 0x28, 0xc7, 0x3f, 0x09, 0xb3,
+		0xa3, 0xb7, 0x5e, 0x66, 0x2a, 0x25, 0x94, 0x41, 0x0a, 0xe4, 0x96, 0xb2, 0xe2, 0xe6, 0x60, 0x9e,
+		0x31, 0xe6, 0xe0, 0x2c, 0xc8, 0x37, 0xf0, 0x53, 0xd2, 0x1f, 0x37, 0xff, 0x4f, 0x51, 0x95, 0x0b,
+		0xbe, 0x26, 0x38, 0xd0, 0x9d, 0xd7, 0xa4, 0x93, 0x09, 0x30, 0x80, 0x6d, 0x07, 0x03, 0xb1, 0xf6}
+
+	expectedAuthtag := []byte{
+		0x4d, 0xd3, 0xb4, 0xc0, 0x88, 0xa7, 0xf4, 0x5c, 0x21, 0x68, 0x39, 0x64, 0x5b, 0x20, 0x12, 0xbf,
+		0x2e, 0x62, 0x69, 0xa8, 0xc5, 0x6a, 0x81, 0x6d, 0xbc, 0x1b, 0x26, 0x77, 0x61, 0x95, 0x5b, 0xc5}
+
+	key := []byte{
+		0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
+		0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
+		0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
+		0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f}
+
+	nonce := []byte{
+		0x1a, 0xf3, 0x8c, 0x2d, 0xc2, 0xb9, 0x6f, 0xfd, 0xd8, 0x66, 0x94, 0x09, 0x23, 0x41, 0xbc, 0x04}
+
+	enc, err := NewCBCHMAC(key, aes.NewCipher)
+	out := enc.Seal(nil, nonce, plaintext, aad)
+	if err != nil {
+		t.Error("Unable to encrypt:", err)
+		return
+	}
+
+	if bytes.Compare(out[:len(out)-32], expectedCiphertext) != 0 {
+		t.Error("Ciphertext did not match, got", out[:len(out)-32], "wanted", expectedCiphertext)
+	}
+	if bytes.Compare(out[len(out)-32:], expectedAuthtag) != 0 {
+		t.Error("Auth tag did not match, got", out[len(out)-32:], "wanted", expectedAuthtag)
+	}
+}
+
+func TestAESCBCRoundtrip(t *testing.T) {
+	key128 := []byte{
+		0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15,
+		0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15}
+
+	key192 := []byte{
+		0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15,
+		0, 1, 2, 3, 4, 5, 6, 7,
+		0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15,
+		0, 1, 2, 3, 4, 5, 6, 7}
+
+	key256 := []byte{
+		0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15,
+		0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15,
+		0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15,
+		0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15}
+
+	nonce := []byte{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15}
+
+	RunRoundtrip(t, key128, nonce)
+	RunRoundtrip(t, key192, nonce)
+	RunRoundtrip(t, key256, nonce)
+}
+
+func RunRoundtrip(t *testing.T, key, nonce []byte) {
+	aead, err := NewCBCHMAC(key, aes.NewCipher)
+	if err != nil {
+		panic(err)
+	}
+
+	if aead.NonceSize() != len(nonce) {
+		panic("invalid nonce")
+	}
+
+	// Test pre-existing data in dst buffer
+	dst := []byte{15, 15, 15, 15}
+	plaintext := []byte{0, 0, 0, 0}
+	aad := []byte{4, 3, 2, 1}
+
+	result := aead.Seal(dst, nonce, plaintext, aad)
+	if bytes.Compare(dst, result[:4]) != 0 {
+		t.Error("Existing data in dst not preserved")
+	}
+
+	// Test pre-existing (empty) dst buffer with sufficient capacity
+	dst = make([]byte, 256)[:0]
+	result, err = aead.Open(dst, nonce, result[4:], aad)
+	if err != nil {
+		panic(err)
+	}
+
+	if bytes.Compare(result, plaintext) != 0 {
+		t.Error("Plaintext does not match output")
+	}
+}
+
+func TestAESCBCOverhead(t *testing.T) {
+	aead, err := NewCBCHMAC(make([]byte, 32), aes.NewCipher)
+	if err != nil {
+		panic(err)
+	}
+
+	if aead.Overhead() != 32 {
+		t.Error("CBC-HMAC reports incorrect overhead value")
+	}
+}
+
+func TestPadding(t *testing.T) {
+	for i := 0; i < 256; i++ {
+		slice := make([]byte, i)
+		padded := padBuffer(slice, 16)
+		if len(padded)%16 != 0 {
+			t.Error("failed to pad slice properly", i)
+			return
+		}
+		unpadded, err := unpadBuffer(padded, 16)
+		if err != nil || len(unpadded) != i {
+			t.Error("failed to unpad slice properly", i)
+			return
+		}
+	}
+}
+
+func TestInvalidKey(t *testing.T) {
+	key := make([]byte, 30)
+	_, err := NewCBCHMAC(key, aes.NewCipher)
+	if err == nil {
+		t.Error("should not be able to instantiate CBC-HMAC with invalid key")
+	}
+}
+
+func TestTruncatedCiphertext(t *testing.T) {
+	key := make([]byte, 32)
+	nonce := make([]byte, 16)
+	data := make([]byte, 32)
+
+	io.ReadFull(rand.Reader, key)
+	io.ReadFull(rand.Reader, nonce)
+
+	aead, err := NewCBCHMAC(key, aes.NewCipher)
+	if err != nil {
+		panic(err)
+	}
+
+	ctx := aead.(*cbcAEAD)
+	ct := aead.Seal(nil, nonce, data, nil)
+
+	// Truncated ciphertext, but with correct auth tag
+	truncated, tail := resize(ct[:len(ct)-ctx.authtagBytes-2], uint64(len(ct))-2)
+	copy(tail, ctx.computeAuthTag(nil, nonce, truncated[:len(truncated)-ctx.authtagBytes]))
+
+	// Open should fail
+	_, err = aead.Open(nil, nonce, truncated, nil)
+	if err == nil {
+		t.Error("open on truncated ciphertext should fail")
+	}
+}
+
+func TestInvalidPaddingOpen(t *testing.T) {
+	key := make([]byte, 32)
+	nonce := make([]byte, 16)
+
+	// Plaintext with invalid padding
+	plaintext := padBuffer(make([]byte, 28), aes.BlockSize)
+	plaintext[len(plaintext)-1] = 0xFF
+
+	io.ReadFull(rand.Reader, key)
+	io.ReadFull(rand.Reader, nonce)
+
+	block, _ := aes.NewCipher(key)
+	cbc := cipher.NewCBCEncrypter(block, nonce)
+	buffer := append([]byte{}, plaintext...)
+	cbc.CryptBlocks(buffer, buffer)
+
+	aead, _ := NewCBCHMAC(key, aes.NewCipher)
+	ctx := aead.(*cbcAEAD)
+
+	// Mutated ciphertext, but with correct auth tag
+	size := uint64(len(buffer))
+	ciphertext, tail := resize(buffer, size+(uint64(len(key))/2))
+	copy(tail, ctx.computeAuthTag(nil, nonce, ciphertext[:size]))
+
+	// Open should fail (b/c of invalid padding, even though tag matches)
+	_, err := aead.Open(nil, nonce, ciphertext, nil)
+	if err == nil || !strings.Contains(err.Error(), "invalid padding") {
+		t.Error("no or unexpected error on open with invalid padding:", err)
+	}
+}
+
+func TestInvalidPadding(t *testing.T) {
+	for i := 0; i < 256; i++ {
+		slice := make([]byte, i)
+		padded := padBuffer(slice, 16)
+		if len(padded)%16 != 0 {
+			t.Error("failed to pad slice properly", i)
+			return
+		}
+
+		paddingBytes := 16 - (i % 16)
+
+		// Mutate padding for testing
+		for j := 1; j <= paddingBytes; j++ {
+			mutated := make([]byte, len(padded))
+			copy(mutated, padded)
+			mutated[len(mutated)-j] ^= 0xFF
+
+			_, err := unpadBuffer(mutated, 16)
+			if err == nil {
+				t.Error("unpad on invalid padding should fail", i)
+				return
+			}
+		}
+
+		// Test truncated padding
+		_, err := unpadBuffer(padded[:len(padded)-1], 16)
+		if err == nil {
+			t.Error("unpad on truncated padding should fail", i)
+			return
+		}
+	}
+}
+
+func TestZeroLengthPadding(t *testing.T) {
+	data := make([]byte, 16)
+	data, err := unpadBuffer(data, 16)
+	if err == nil {
+		t.Error("padding with 0x00 should never be valid")
+	}
+}
+
+func benchEncryptCBCHMAC(b *testing.B, keySize, chunkSize int) {
+	key := make([]byte, keySize*2)
+	nonce := make([]byte, 16)
+
+	io.ReadFull(rand.Reader, key)
+	io.ReadFull(rand.Reader, nonce)
+
+	chunk := make([]byte, chunkSize)
+
+	aead, err := NewCBCHMAC(key, aes.NewCipher)
+	if err != nil {
+		panic(err)
+	}
+
+	b.SetBytes(int64(chunkSize))
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		aead.Seal(nil, nonce, chunk, nil)
+	}
+}
+
+func benchDecryptCBCHMAC(b *testing.B, keySize, chunkSize int) {
+	key := make([]byte, keySize*2)
+	nonce := make([]byte, 16)
+
+	io.ReadFull(rand.Reader, key)
+	io.ReadFull(rand.Reader, nonce)
+
+	chunk := make([]byte, chunkSize)
+
+	aead, err := NewCBCHMAC(key, aes.NewCipher)
+	if err != nil {
+		panic(err)
+	}
+
+	out := aead.Seal(nil, nonce, chunk, nil)
+
+	b.SetBytes(int64(chunkSize))
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		aead.Open(nil, nonce, out, nil)
+	}
+}
+
+func BenchmarkEncryptAES128_CBCHMAC_1k(b *testing.B) {
+	benchEncryptCBCHMAC(b, 16, 1024)
+}
+
+func BenchmarkEncryptAES128_CBCHMAC_64k(b *testing.B) {
+	benchEncryptCBCHMAC(b, 16, 65536)
+}
+
+func BenchmarkEncryptAES128_CBCHMAC_1MB(b *testing.B) {
+	benchEncryptCBCHMAC(b, 16, 1048576)
+}
+
+func BenchmarkEncryptAES128_CBCHMAC_64MB(b *testing.B) {
+	benchEncryptCBCHMAC(b, 16, 67108864)
+}
+
+func BenchmarkDecryptAES128_CBCHMAC_1k(b *testing.B) {
+	benchDecryptCBCHMAC(b, 16, 1024)
+}
+
+func BenchmarkDecryptAES128_CBCHMAC_64k(b *testing.B) {
+	benchDecryptCBCHMAC(b, 16, 65536)
+}
+
+func BenchmarkDecryptAES128_CBCHMAC_1MB(b *testing.B) {
+	benchDecryptCBCHMAC(b, 16, 1048576)
+}
+
+func BenchmarkDecryptAES128_CBCHMAC_64MB(b *testing.B) {
+	benchDecryptCBCHMAC(b, 16, 67108864)
+}
+
+func BenchmarkEncryptAES192_CBCHMAC_64k(b *testing.B) {
+	benchEncryptCBCHMAC(b, 24, 65536)
+}
+
+func BenchmarkEncryptAES192_CBCHMAC_1MB(b *testing.B) {
+	benchEncryptCBCHMAC(b, 24, 1048576)
+}
+
+func BenchmarkEncryptAES192_CBCHMAC_64MB(b *testing.B) {
+	benchEncryptCBCHMAC(b, 24, 67108864)
+}
+
+func BenchmarkDecryptAES192_CBCHMAC_1k(b *testing.B) {
+	benchDecryptCBCHMAC(b, 24, 1024)
+}
+
+func BenchmarkDecryptAES192_CBCHMAC_64k(b *testing.B) {
+	benchDecryptCBCHMAC(b, 24, 65536)
+}
+
+func BenchmarkDecryptAES192_CBCHMAC_1MB(b *testing.B) {
+	benchDecryptCBCHMAC(b, 24, 1048576)
+}
+
+func BenchmarkDecryptAES192_CBCHMAC_64MB(b *testing.B) {
+	benchDecryptCBCHMAC(b, 24, 67108864)
+}
+
+func BenchmarkEncryptAES256_CBCHMAC_64k(b *testing.B) {
+	benchEncryptCBCHMAC(b, 32, 65536)
+}
+
+func BenchmarkEncryptAES256_CBCHMAC_1MB(b *testing.B) {
+	benchEncryptCBCHMAC(b, 32, 1048576)
+}
+
+func BenchmarkEncryptAES256_CBCHMAC_64MB(b *testing.B) {
+	benchEncryptCBCHMAC(b, 32, 67108864)
+}
+
+func BenchmarkDecryptAES256_CBCHMAC_1k(b *testing.B) {
+	benchDecryptCBCHMAC(b, 32, 1032)
+}
+
+func BenchmarkDecryptAES256_CBCHMAC_64k(b *testing.B) {
+	benchDecryptCBCHMAC(b, 32, 65536)
+}
+
+func BenchmarkDecryptAES256_CBCHMAC_1MB(b *testing.B) {
+	benchDecryptCBCHMAC(b, 32, 1048576)
+}
+
+func BenchmarkDecryptAES256_CBCHMAC_64MB(b *testing.B) {
+	benchDecryptCBCHMAC(b, 32, 67108864)
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/cipher/concat_kdf.go b/vendor/gopkg.in/square/go-jose.v2/cipher/concat_kdf.go
new file mode 100644
index 0000000..f62c3bd
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/cipher/concat_kdf.go
@@ -0,0 +1,75 @@
+/*-
+ * Copyright 2014 Square Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package josecipher
+
+import (
+	"crypto"
+	"encoding/binary"
+	"hash"
+	"io"
+)
+
+type concatKDF struct {
+	z, info []byte
+	i       uint32
+	cache   []byte
+	hasher  hash.Hash
+}
+
+// NewConcatKDF builds a KDF reader based on the given inputs.
+func NewConcatKDF(hash crypto.Hash, z, algID, ptyUInfo, ptyVInfo, supPubInfo, supPrivInfo []byte) io.Reader {
+	buffer := make([]byte, uint64(len(algID))+uint64(len(ptyUInfo))+uint64(len(ptyVInfo))+uint64(len(supPubInfo))+uint64(len(supPrivInfo)))
+	n := 0
+	n += copy(buffer, algID)
+	n += copy(buffer[n:], ptyUInfo)
+	n += copy(buffer[n:], ptyVInfo)
+	n += copy(buffer[n:], supPubInfo)
+	copy(buffer[n:], supPrivInfo)
+
+	hasher := hash.New()
+
+	return &concatKDF{
+		z:      z,
+		info:   buffer,
+		hasher: hasher,
+		cache:  []byte{},
+		i:      1,
+	}
+}
+
+func (ctx *concatKDF) Read(out []byte) (int, error) {
+	copied := copy(out, ctx.cache)
+	ctx.cache = ctx.cache[copied:]
+
+	for copied < len(out) {
+		ctx.hasher.Reset()
+
+		// Write on a hash.Hash never fails
+		_ = binary.Write(ctx.hasher, binary.BigEndian, ctx.i)
+		_, _ = ctx.hasher.Write(ctx.z)
+		_, _ = ctx.hasher.Write(ctx.info)
+
+		hash := ctx.hasher.Sum(nil)
+		chunkCopied := copy(out[copied:], hash)
+		copied += chunkCopied
+		ctx.cache = hash[chunkCopied:]
+
+		ctx.i++
+	}
+
+	return copied, nil
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/cipher/concat_kdf_test.go b/vendor/gopkg.in/square/go-jose.v2/cipher/concat_kdf_test.go
new file mode 100644
index 0000000..48219b3
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/cipher/concat_kdf_test.go
@@ -0,0 +1,150 @@
+/*-
+ * Copyright 2014 Square Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package josecipher
+
+import (
+	"bytes"
+	"crypto"
+	"testing"
+)
+
+// Taken from: https://tools.ietf.org/id/draft-ietf-jose-json-web-algorithms-38.txt
+func TestVectorConcatKDF(t *testing.T) {
+	z := []byte{
+		158, 86, 217, 29, 129, 113, 53, 211, 114, 131, 66, 131, 191, 132,
+		38, 156, 251, 49, 110, 163, 218, 128, 106, 72, 246, 218, 167, 121,
+		140, 254, 144, 196}
+
+	algID := []byte{0, 0, 0, 7, 65, 49, 50, 56, 71, 67, 77}
+
+	ptyUInfo := []byte{0, 0, 0, 5, 65, 108, 105, 99, 101}
+	ptyVInfo := []byte{0, 0, 0, 3, 66, 111, 98}
+
+	supPubInfo := []byte{0, 0, 0, 128}
+	supPrivInfo := []byte{}
+
+	expected := []byte{
+		86, 170, 141, 234, 248, 35, 109, 32, 92, 34, 40, 205, 113, 167, 16, 26}
+
+	ckdf := NewConcatKDF(crypto.SHA256, z, algID, ptyUInfo, ptyVInfo, supPubInfo, supPrivInfo)
+
+	out0 := make([]byte, 9)
+	out1 := make([]byte, 7)
+
+	read0, err := ckdf.Read(out0)
+	if err != nil {
+		t.Error("error when reading from concat kdf reader", err)
+		return
+	}
+
+	read1, err := ckdf.Read(out1)
+	if err != nil {
+		t.Error("error when reading from concat kdf reader", err)
+		return
+	}
+
+	if read0+read1 != len(out0)+len(out1) {
+		t.Error("did not receive enough bytes from concat kdf reader")
+		return
+	}
+
+	out := []byte{}
+	out = append(out, out0...)
+	out = append(out, out1...)
+
+	if bytes.Compare(out, expected) != 0 {
+		t.Error("did not receive expected output from concat kdf reader")
+		return
+	}
+}
+
+func TestCache(t *testing.T) {
+	z := []byte{
+		158, 86, 217, 29, 129, 113, 53, 211, 114, 131, 66, 131, 191, 132,
+		38, 156, 251, 49, 110, 163, 218, 128, 106, 72, 246, 218, 167, 121,
+		140, 254, 144, 196}
+
+	algID := []byte{1, 1, 1, 1, 2, 2, 2, 2, 3, 3, 3, 3, 4, 4, 4, 4}
+
+	ptyUInfo := []byte{1, 2, 3, 4}
+	ptyVInfo := []byte{4, 3, 2, 1}
+
+	supPubInfo := []byte{}
+	supPrivInfo := []byte{}
+
+	outputs := [][]byte{}
+
+	// Read the same amount of data in different chunk sizes
+	chunkSizes := []int{1, 2, 4, 8, 16, 32, 64, 128, 256, 512}
+
+	for _, c := range chunkSizes {
+		out := make([]byte, 1024)
+		reader := NewConcatKDF(crypto.SHA256, z, algID, ptyUInfo, ptyVInfo, supPubInfo, supPrivInfo)
+
+		for i := 0; i < 1024; i += c {
+			_, _ = reader.Read(out[i : i+c])
+		}
+
+		outputs = append(outputs, out)
+	}
+
+	for i := range outputs {
+		if bytes.Compare(outputs[i], outputs[(i+1)%len(outputs)]) != 0 {
+			t.Error("not all outputs from KDF matched")
+		}
+	}
+}
+
+func benchmarkKDF(b *testing.B, total int) {
+	z := []byte{
+		158, 86, 217, 29, 129, 113, 53, 211, 114, 131, 66, 131, 191, 132,
+		38, 156, 251, 49, 110, 163, 218, 128, 106, 72, 246, 218, 167, 121,
+		140, 254, 144, 196}
+
+	algID := []byte{1, 1, 1, 1, 2, 2, 2, 2, 3, 3, 3, 3, 4, 4, 4, 4}
+
+	ptyUInfo := []byte{1, 2, 3, 4}
+	ptyVInfo := []byte{4, 3, 2, 1}
+
+	supPubInfo := []byte{}
+	supPrivInfo := []byte{}
+
+	out := make([]byte, total)
+	reader := NewConcatKDF(crypto.SHA256, z, algID, ptyUInfo, ptyVInfo, supPubInfo, supPrivInfo)
+
+	b.ResetTimer()
+	b.SetBytes(int64(total))
+	for i := 0; i < b.N; i++ {
+		_, _ = reader.Read(out)
+	}
+}
+
+func BenchmarkConcatKDF_1k(b *testing.B) {
+	benchmarkKDF(b, 1024)
+}
+
+func BenchmarkConcatKDF_64k(b *testing.B) {
+	benchmarkKDF(b, 65536)
+}
+
+func BenchmarkConcatKDF_1MB(b *testing.B) {
+	benchmarkKDF(b, 1048576)
+}
+
+func BenchmarkConcatKDF_64MB(b *testing.B) {
+	benchmarkKDF(b, 67108864)
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/cipher/ecdh_es.go b/vendor/gopkg.in/square/go-jose.v2/cipher/ecdh_es.go
new file mode 100644
index 0000000..c128e32
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/cipher/ecdh_es.go
@@ -0,0 +1,62 @@
+/*-
+ * Copyright 2014 Square Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package josecipher
+
+import (
+	"crypto"
+	"crypto/ecdsa"
+	"encoding/binary"
+)
+
+// DeriveECDHES derives a shared encryption key using ECDH/ConcatKDF as described in JWE/JWA.
+// It is an error to call this function with a private/public key that are not on the same
+// curve. Callers must ensure that the keys are valid before calling this function. Output
+// size may be at most 1<<16 bytes (64 KiB).
+func DeriveECDHES(alg string, apuData, apvData []byte, priv *ecdsa.PrivateKey, pub *ecdsa.PublicKey, size int) []byte {
+	if size > 1<<16 {
+		panic("ECDH-ES output size too large, must be less than or equal to 1<<16")
+	}
+
+	// algId, partyUInfo, partyVInfo inputs must be prefixed with the length
+	algID := lengthPrefixed([]byte(alg))
+	ptyUInfo := lengthPrefixed(apuData)
+	ptyVInfo := lengthPrefixed(apvData)
+
+	// suppPubInfo is the encoded length of the output size in bits
+	supPubInfo := make([]byte, 4)
+	binary.BigEndian.PutUint32(supPubInfo, uint32(size)*8)
+
+	if !priv.PublicKey.Curve.IsOnCurve(pub.X, pub.Y) {
+		panic("public key not on same curve as private key")
+	}
+
+	z, _ := priv.PublicKey.Curve.ScalarMult(pub.X, pub.Y, priv.D.Bytes())
+	reader := NewConcatKDF(crypto.SHA256, z.Bytes(), algID, ptyUInfo, ptyVInfo, supPubInfo, []byte{})
+
+	key := make([]byte, size)
+
+	// Read on the KDF will never fail
+	_, _ = reader.Read(key)
+	return key
+}
+
+func lengthPrefixed(data []byte) []byte {
+	out := make([]byte, len(data)+4)
+	binary.BigEndian.PutUint32(out, uint32(len(data)))
+	copy(out[4:], data)
+	return out
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/cipher/ecdh_es_test.go b/vendor/gopkg.in/square/go-jose.v2/cipher/ecdh_es_test.go
new file mode 100644
index 0000000..58fb4c6
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/cipher/ecdh_es_test.go
@@ -0,0 +1,115 @@
+/*-
+ * Copyright 2014 Square Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package josecipher
+
+import (
+	"bytes"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"encoding/base64"
+	"math/big"
+	"testing"
+)
+
+// Example keys from JWA, Appendix C
+var aliceKey = &ecdsa.PrivateKey{
+	PublicKey: ecdsa.PublicKey{
+		Curve: elliptic.P256(),
+		X:     fromBase64Int("gI0GAILBdu7T53akrFmMyGcsF3n5dO7MmwNBHKW5SV0="),
+		Y:     fromBase64Int("SLW_xSffzlPWrHEVI30DHM_4egVwt3NQqeUD7nMFpps="),
+	},
+	D: fromBase64Int("0_NxaRPUMQoAJt50Gz8YiTr8gRTwyEaCumd-MToTmIo="),
+}
+
+var bobKey = &ecdsa.PrivateKey{
+	PublicKey: ecdsa.PublicKey{
+		Curve: elliptic.P256(),
+		X:     fromBase64Int("weNJy2HscCSM6AEDTDg04biOvhFhyyWvOHQfeF_PxMQ="),
+		Y:     fromBase64Int("e8lnCO-AlStT-NJVX-crhB7QRYhiix03illJOVAOyck="),
+	},
+	D: fromBase64Int("VEmDZpDXXK8p8N0Cndsxs924q6nS1RXFASRl6BfUqdw="),
+}
+
+// Build big int from base64-encoded string. Strips whitespace (for testing).
+func fromBase64Int(data string) *big.Int {
+	val, err := base64.URLEncoding.DecodeString(data)
+	if err != nil {
+		panic("Invalid test data: " + err.Error())
+	}
+	return new(big.Int).SetBytes(val)
+}
+
+func TestVectorECDHES(t *testing.T) {
+	apuData := []byte("Alice")
+	apvData := []byte("Bob")
+
+	expected := []byte{
+		86, 170, 141, 234, 248, 35, 109, 32, 92, 34, 40, 205, 113, 167, 16, 26}
+
+	output := DeriveECDHES("A128GCM", apuData, apvData, bobKey, &aliceKey.PublicKey, 16)
+
+	if bytes.Compare(output, expected) != 0 {
+		t.Error("output did not match what we expect, got", output, "wanted", expected)
+	}
+}
+
+func TestInvalidECPublicKey(t *testing.T) {
+	defer func() { recover() }()
+
+	// Invalid key
+	invalid := &ecdsa.PrivateKey{
+		PublicKey: ecdsa.PublicKey{
+			Curve: elliptic.P256(),
+			X:     fromBase64Int("MTEx"),
+			Y:     fromBase64Int("MTEx"),
+		},
+		D: fromBase64Int("0_NxaRPUMQoAJt50Gz8YiTr8gRTwyEaCumd-MToTmIo="),
+	}
+
+	DeriveECDHES("A128GCM", []byte{}, []byte{}, bobKey, &invalid.PublicKey, 16)
+	t.Fatal("should panic if public key was invalid")
+}
+
+func BenchmarkECDHES_128(b *testing.B) {
+	apuData := []byte("APU")
+	apvData := []byte("APV")
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		DeriveECDHES("ID", apuData, apvData, bobKey, &aliceKey.PublicKey, 16)
+	}
+}
+
+func BenchmarkECDHES_192(b *testing.B) {
+	apuData := []byte("APU")
+	apvData := []byte("APV")
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		DeriveECDHES("ID", apuData, apvData, bobKey, &aliceKey.PublicKey, 24)
+	}
+}
+
+func BenchmarkECDHES_256(b *testing.B) {
+	apuData := []byte("APU")
+	apvData := []byte("APV")
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		DeriveECDHES("ID", apuData, apvData, bobKey, &aliceKey.PublicKey, 32)
+	}
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/cipher/key_wrap.go b/vendor/gopkg.in/square/go-jose.v2/cipher/key_wrap.go
new file mode 100644
index 0000000..1d36d50
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/cipher/key_wrap.go
@@ -0,0 +1,109 @@
+/*-
+ * Copyright 2014 Square Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package josecipher
+
+import (
+	"crypto/cipher"
+	"crypto/subtle"
+	"encoding/binary"
+	"errors"
+)
+
+var defaultIV = []byte{0xA6, 0xA6, 0xA6, 0xA6, 0xA6, 0xA6, 0xA6, 0xA6}
+
+// KeyWrap implements NIST key wrapping; it wraps a content encryption key (cek) with the given block cipher.
+func KeyWrap(block cipher.Block, cek []byte) ([]byte, error) {
+	if len(cek)%8 != 0 {
+		return nil, errors.New("square/go-jose: key wrap input must be 8 byte blocks")
+	}
+
+	n := len(cek) / 8
+	r := make([][]byte, n)
+
+	for i := range r {
+		r[i] = make([]byte, 8)
+		copy(r[i], cek[i*8:])
+	}
+
+	buffer := make([]byte, 16)
+	tBytes := make([]byte, 8)
+	copy(buffer, defaultIV)
+
+	for t := 0; t < 6*n; t++ {
+		copy(buffer[8:], r[t%n])
+
+		block.Encrypt(buffer, buffer)
+
+		binary.BigEndian.PutUint64(tBytes, uint64(t+1))
+
+		for i := 0; i < 8; i++ {
+			buffer[i] = buffer[i] ^ tBytes[i]
+		}
+		copy(r[t%n], buffer[8:])
+	}
+
+	out := make([]byte, (n+1)*8)
+	copy(out, buffer[:8])
+	for i := range r {
+		copy(out[(i+1)*8:], r[i])
+	}
+
+	return out, nil
+}
+
+// KeyUnwrap implements NIST key unwrapping; it unwraps a content encryption key (cek) with the given block cipher.
+func KeyUnwrap(block cipher.Block, ciphertext []byte) ([]byte, error) {
+	if len(ciphertext)%8 != 0 {
+		return nil, errors.New("square/go-jose: key wrap input must be 8 byte blocks")
+	}
+
+	n := (len(ciphertext) / 8) - 1
+	r := make([][]byte, n)
+
+	for i := range r {
+		r[i] = make([]byte, 8)
+		copy(r[i], ciphertext[(i+1)*8:])
+	}
+
+	buffer := make([]byte, 16)
+	tBytes := make([]byte, 8)
+	copy(buffer[:8], ciphertext[:8])
+
+	for t := 6*n - 1; t >= 0; t-- {
+		binary.BigEndian.PutUint64(tBytes, uint64(t+1))
+
+		for i := 0; i < 8; i++ {
+			buffer[i] = buffer[i] ^ tBytes[i]
+		}
+		copy(buffer[8:], r[t%n])
+
+		block.Decrypt(buffer, buffer)
+
+		copy(r[t%n], buffer[8:])
+	}
+
+	if subtle.ConstantTimeCompare(buffer[:8], defaultIV) == 0 {
+		return nil, errors.New("square/go-jose: failed to unwrap key")
+	}
+
+	out := make([]byte, n*8)
+	for i := range r {
+		copy(out[i*8:], r[i])
+	}
+
+	return out, nil
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/cipher/key_wrap_test.go b/vendor/gopkg.in/square/go-jose.v2/cipher/key_wrap_test.go
new file mode 100644
index 0000000..ceecf81
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/cipher/key_wrap_test.go
@@ -0,0 +1,133 @@
+/*-
+ * Copyright 2014 Square Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package josecipher
+
+import (
+	"bytes"
+	"crypto/aes"
+	"encoding/hex"
+	"testing"
+)
+
+func TestAesKeyWrap(t *testing.T) {
+	// Test vectors from: http://csrc.nist.gov/groups/ST/toolkit/documents/kms/key-wrap.pdf
+	kek0, _ := hex.DecodeString("000102030405060708090A0B0C0D0E0F")
+	cek0, _ := hex.DecodeString("00112233445566778899AABBCCDDEEFF")
+
+	expected0, _ := hex.DecodeString("1FA68B0A8112B447AEF34BD8FB5A7B829D3E862371D2CFE5")
+
+	kek1, _ := hex.DecodeString("000102030405060708090A0B0C0D0E0F1011121314151617")
+	cek1, _ := hex.DecodeString("00112233445566778899AABBCCDDEEFF")
+
+	expected1, _ := hex.DecodeString("96778B25AE6CA435F92B5B97C050AED2468AB8A17AD84E5D")
+
+	kek2, _ := hex.DecodeString("000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F")
+	cek2, _ := hex.DecodeString("00112233445566778899AABBCCDDEEFF0001020304050607")
+
+	expected2, _ := hex.DecodeString("A8F9BC1612C68B3FF6E6F4FBE30E71E4769C8B80A32CB8958CD5D17D6B254DA1")
+
+	block0, _ := aes.NewCipher(kek0)
+	block1, _ := aes.NewCipher(kek1)
+	block2, _ := aes.NewCipher(kek2)
+
+	out0, _ := KeyWrap(block0, cek0)
+	out1, _ := KeyWrap(block1, cek1)
+	out2, _ := KeyWrap(block2, cek2)
+
+	if bytes.Compare(out0, expected0) != 0 {
+		t.Error("output 0 not as expected, got", out0, "wanted", expected0)
+	}
+
+	if bytes.Compare(out1, expected1) != 0 {
+		t.Error("output 1 not as expected, got", out1, "wanted", expected1)
+	}
+
+	if bytes.Compare(out2, expected2) != 0 {
+		t.Error("output 2 not as expected, got", out2, "wanted", expected2)
+	}
+
+	unwrap0, _ := KeyUnwrap(block0, out0)
+	unwrap1, _ := KeyUnwrap(block1, out1)
+	unwrap2, _ := KeyUnwrap(block2, out2)
+
+	if bytes.Compare(unwrap0, cek0) != 0 {
+		t.Error("key unwrap did not return original input, got", unwrap0, "wanted", cek0)
+	}
+
+	if bytes.Compare(unwrap1, cek1) != 0 {
+		t.Error("key unwrap did not return original input, got", unwrap1, "wanted", cek1)
+	}
+
+	if bytes.Compare(unwrap2, cek2) != 0 {
+		t.Error("key unwrap did not return original input, got", unwrap2, "wanted", cek2)
+	}
+}
+
+func TestAesKeyWrapInvalid(t *testing.T) {
+	kek, _ := hex.DecodeString("000102030405060708090A0B0C0D0E0F")
+
+	// Invalid unwrap input (bit flipped)
+	input0, _ := hex.DecodeString("1EA68C1A8112B447AEF34BD8FB5A7B828D3E862371D2CFE5")
+
+	block, _ := aes.NewCipher(kek)
+
+	_, err := KeyUnwrap(block, input0)
+	if err == nil {
+		t.Error("key unwrap failed to detect invalid input")
+	}
+
+	// Invalid unwrap input (truncated)
+	input1, _ := hex.DecodeString("1EA68C1A8112B447AEF34BD8FB5A7B828D3E862371D2CF")
+
+	_, err = KeyUnwrap(block, input1)
+	if err == nil {
+		t.Error("key unwrap failed to detect truncated input")
+	}
+
+	// Invalid wrap input (not multiple of 8)
+	input2, _ := hex.DecodeString("0123456789ABCD")
+
+	_, err = KeyWrap(block, input2)
+	if err == nil {
+		t.Error("key wrap accepted invalid input")
+	}
+
+}
+
+func BenchmarkAesKeyWrap(b *testing.B) {
+	kek, _ := hex.DecodeString("000102030405060708090A0B0C0D0E0F")
+	key, _ := hex.DecodeString("FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF")
+
+	block, _ := aes.NewCipher(kek)
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		KeyWrap(block, key)
+	}
+}
+
+func BenchmarkAesKeyUnwrap(b *testing.B) {
+	kek, _ := hex.DecodeString("000102030405060708090A0B0C0D0E0F")
+	input, _ := hex.DecodeString("1FA68B0A8112B447AEF34BD8FB5A7B829D3E862371D2CFE5")
+
+	block, _ := aes.NewCipher(kek)
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		KeyUnwrap(block, input)
+	}
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/crypter.go b/vendor/gopkg.in/square/go-jose.v2/crypter.go
new file mode 100644
index 0000000..c45c712
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/crypter.go
@@ -0,0 +1,535 @@
+/*-
+ * Copyright 2014 Square Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package jose
+
+import (
+	"crypto/ecdsa"
+	"crypto/rsa"
+	"errors"
+	"fmt"
+	"reflect"
+
+	"gopkg.in/square/go-jose.v2/json"
+)
+
+// Encrypter represents an encrypter which produces an encrypted JWE object.
+type Encrypter interface {
+	Encrypt(plaintext []byte) (*JSONWebEncryption, error)
+	EncryptWithAuthData(plaintext []byte, aad []byte) (*JSONWebEncryption, error)
+	Options() EncrypterOptions
+}
+
+// A generic content cipher
+type contentCipher interface {
+	keySize() int
+	encrypt(cek []byte, aad, plaintext []byte) (*aeadParts, error)
+	decrypt(cek []byte, aad []byte, parts *aeadParts) ([]byte, error)
+}
+
+// A key generator (for generating/getting a CEK)
+type keyGenerator interface {
+	keySize() int
+	genKey() ([]byte, rawHeader, error)
+}
+
+// A generic key encrypter
+type keyEncrypter interface {
+	encryptKey(cek []byte, alg KeyAlgorithm) (recipientInfo, error) // Encrypt a key
+}
+
+// A generic key decrypter
+type keyDecrypter interface {
+	decryptKey(headers rawHeader, recipient *recipientInfo, generator keyGenerator) ([]byte, error) // Decrypt a key
+}
+
+// A generic encrypter based on the given key encrypter and content cipher.
+type genericEncrypter struct {
+	contentAlg     ContentEncryption
+	compressionAlg CompressionAlgorithm
+	cipher         contentCipher
+	recipients     []recipientKeyInfo
+	keyGenerator   keyGenerator
+	extraHeaders   map[HeaderKey]interface{}
+}
+
+type recipientKeyInfo struct {
+	keyID        string
+	keyAlg       KeyAlgorithm
+	keyEncrypter keyEncrypter
+}
+
+// EncrypterOptions represents options that can be set on new encrypters.
+type EncrypterOptions struct {
+	Compression CompressionAlgorithm
+
+	// Optional map of additional keys to be inserted into the protected header
+	// of a JWS object. Some specifications which make use of JWS like to insert
+	// additional values here. All values must be JSON-serializable.
+	ExtraHeaders map[HeaderKey]interface{}
+}
+
+// WithHeader adds an arbitrary value to the ExtraHeaders map, initializing it
+// if necessary. It returns itself and so can be used in a fluent style.
+func (eo *EncrypterOptions) WithHeader(k HeaderKey, v interface{}) *EncrypterOptions {
+	if eo.ExtraHeaders == nil {
+		eo.ExtraHeaders = map[HeaderKey]interface{}{}
+	}
+	eo.ExtraHeaders[k] = v
+	return eo
+}
+
+// WithContentType adds a content type ("cty") header and returns the updated
+// EncrypterOptions.
+func (eo *EncrypterOptions) WithContentType(contentType ContentType) *EncrypterOptions {
+	return eo.WithHeader(HeaderContentType, contentType)
+}
+
+// WithType adds a type ("typ") header and returns the updated EncrypterOptions.
+func (eo *EncrypterOptions) WithType(typ ContentType) *EncrypterOptions {
+	return eo.WithHeader(HeaderType, typ)
+}
+
+// Recipient represents an algorithm/key to encrypt messages to.
+//
+// PBES2Count and PBES2Salt correspond with the  "p2c" and "p2s" headers used
+// on the password-based encryption algorithms PBES2-HS256+A128KW,
+// PBES2-HS384+A192KW, and PBES2-HS512+A256KW. If they are not provided a safe
+// default of 100000 will be used for the count and a 128-bit random salt will
+// be generated.
+type Recipient struct {
+	Algorithm  KeyAlgorithm
+	Key        interface{}
+	KeyID      string
+	PBES2Count int
+	PBES2Salt  []byte
+}
+
+// NewEncrypter creates an appropriate encrypter based on the key type
+func NewEncrypter(enc ContentEncryption, rcpt Recipient, opts *EncrypterOptions) (Encrypter, error) {
+	encrypter := &genericEncrypter{
+		contentAlg: enc,
+		recipients: []recipientKeyInfo{},
+		cipher:     getContentCipher(enc),
+	}
+	if opts != nil {
+		encrypter.compressionAlg = opts.Compression
+		encrypter.extraHeaders = opts.ExtraHeaders
+	}
+
+	if encrypter.cipher == nil {
+		return nil, ErrUnsupportedAlgorithm
+	}
+
+	var keyID string
+	var rawKey interface{}
+	switch encryptionKey := rcpt.Key.(type) {
+	case JSONWebKey:
+		keyID, rawKey = encryptionKey.KeyID, encryptionKey.Key
+	case *JSONWebKey:
+		keyID, rawKey = encryptionKey.KeyID, encryptionKey.Key
+	default:
+		rawKey = encryptionKey
+	}
+
+	switch rcpt.Algorithm {
+	case DIRECT:
+		// Direct encryption mode must be treated differently
+		if reflect.TypeOf(rawKey) != reflect.TypeOf([]byte{}) {
+			return nil, ErrUnsupportedKeyType
+		}
+		if encrypter.cipher.keySize() != len(rawKey.([]byte)) {
+			return nil, ErrInvalidKeySize
+		}
+		encrypter.keyGenerator = staticKeyGenerator{
+			key: rawKey.([]byte),
+		}
+		recipientInfo, _ := newSymmetricRecipient(rcpt.Algorithm, rawKey.([]byte))
+		recipientInfo.keyID = keyID
+		if rcpt.KeyID != "" {
+			recipientInfo.keyID = rcpt.KeyID
+		}
+		encrypter.recipients = []recipientKeyInfo{recipientInfo}
+		return encrypter, nil
+	case ECDH_ES:
+		// ECDH-ES (w/o key wrapping) is similar to DIRECT mode
+		typeOf := reflect.TypeOf(rawKey)
+		if typeOf != reflect.TypeOf(&ecdsa.PublicKey{}) {
+			return nil, ErrUnsupportedKeyType
+		}
+		encrypter.keyGenerator = ecKeyGenerator{
+			size:      encrypter.cipher.keySize(),
+			algID:     string(enc),
+			publicKey: rawKey.(*ecdsa.PublicKey),
+		}
+		recipientInfo, _ := newECDHRecipient(rcpt.Algorithm, rawKey.(*ecdsa.PublicKey))
+		recipientInfo.keyID = keyID
+		if rcpt.KeyID != "" {
+			recipientInfo.keyID = rcpt.KeyID
+		}
+		encrypter.recipients = []recipientKeyInfo{recipientInfo}
+		return encrypter, nil
+	default:
+		// Can just add a standard recipient
+		encrypter.keyGenerator = randomKeyGenerator{
+			size: encrypter.cipher.keySize(),
+		}
+		err := encrypter.addRecipient(rcpt)
+		return encrypter, err
+	}
+}
+
+// NewMultiEncrypter creates a multi-encrypter based on the given parameters
+func NewMultiEncrypter(enc ContentEncryption, rcpts []Recipient, opts *EncrypterOptions) (Encrypter, error) {
+	cipher := getContentCipher(enc)
+
+	if cipher == nil {
+		return nil, ErrUnsupportedAlgorithm
+	}
+	if rcpts == nil || len(rcpts) == 0 {
+		return nil, fmt.Errorf("square/go-jose: recipients is nil or empty")
+	}
+
+	encrypter := &genericEncrypter{
+		contentAlg: enc,
+		recipients: []recipientKeyInfo{},
+		cipher:     cipher,
+		keyGenerator: randomKeyGenerator{
+			size: cipher.keySize(),
+		},
+	}
+
+	if opts != nil {
+		encrypter.compressionAlg = opts.Compression
+	}
+
+	for _, recipient := range rcpts {
+		err := encrypter.addRecipient(recipient)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	return encrypter, nil
+}
+
+func (ctx *genericEncrypter) addRecipient(recipient Recipient) (err error) {
+	var recipientInfo recipientKeyInfo
+
+	switch recipient.Algorithm {
+	case DIRECT, ECDH_ES:
+		return fmt.Errorf("square/go-jose: key algorithm '%s' not supported in multi-recipient mode", recipient.Algorithm)
+	}
+
+	recipientInfo, err = makeJWERecipient(recipient.Algorithm, recipient.Key)
+	if recipient.KeyID != "" {
+		recipientInfo.keyID = recipient.KeyID
+	}
+
+	switch recipient.Algorithm {
+	case PBES2_HS256_A128KW, PBES2_HS384_A192KW, PBES2_HS512_A256KW:
+		if sr, ok := recipientInfo.keyEncrypter.(*symmetricKeyCipher); ok {
+			sr.p2c = recipient.PBES2Count
+			sr.p2s = recipient.PBES2Salt
+		}
+	}
+
+	if err == nil {
+		ctx.recipients = append(ctx.recipients, recipientInfo)
+	}
+	return err
+}
+
+func makeJWERecipient(alg KeyAlgorithm, encryptionKey interface{}) (recipientKeyInfo, error) {
+	switch encryptionKey := encryptionKey.(type) {
+	case *rsa.PublicKey:
+		return newRSARecipient(alg, encryptionKey)
+	case *ecdsa.PublicKey:
+		return newECDHRecipient(alg, encryptionKey)
+	case []byte:
+		return newSymmetricRecipient(alg, encryptionKey)
+	case string:
+		return newSymmetricRecipient(alg, []byte(encryptionKey))
+	case *JSONWebKey:
+		recipient, err := makeJWERecipient(alg, encryptionKey.Key)
+		recipient.keyID = encryptionKey.KeyID
+		return recipient, err
+	default:
+		return recipientKeyInfo{}, ErrUnsupportedKeyType
+	}
+}
+
+// newDecrypter creates an appropriate decrypter based on the key type
+func newDecrypter(decryptionKey interface{}) (keyDecrypter, error) {
+	switch decryptionKey := decryptionKey.(type) {
+	case *rsa.PrivateKey:
+		return &rsaDecrypterSigner{
+			privateKey: decryptionKey,
+		}, nil
+	case *ecdsa.PrivateKey:
+		return &ecDecrypterSigner{
+			privateKey: decryptionKey,
+		}, nil
+	case []byte:
+		return &symmetricKeyCipher{
+			key: decryptionKey,
+		}, nil
+	case string:
+		return &symmetricKeyCipher{
+			key: []byte(decryptionKey),
+		}, nil
+	case JSONWebKey:
+		return newDecrypter(decryptionKey.Key)
+	case *JSONWebKey:
+		return newDecrypter(decryptionKey.Key)
+	default:
+		return nil, ErrUnsupportedKeyType
+	}
+}
+
+// Implementation of encrypt method producing a JWE object.
+func (ctx *genericEncrypter) Encrypt(plaintext []byte) (*JSONWebEncryption, error) {
+	return ctx.EncryptWithAuthData(plaintext, nil)
+}
+
+// Implementation of encrypt method producing a JWE object.
+func (ctx *genericEncrypter) EncryptWithAuthData(plaintext, aad []byte) (*JSONWebEncryption, error) {
+	obj := &JSONWebEncryption{}
+	obj.aad = aad
+
+	obj.protected = &rawHeader{}
+	err := obj.protected.set(headerEncryption, ctx.contentAlg)
+	if err != nil {
+		return nil, err
+	}
+
+	obj.recipients = make([]recipientInfo, len(ctx.recipients))
+
+	if len(ctx.recipients) == 0 {
+		return nil, fmt.Errorf("square/go-jose: no recipients to encrypt to")
+	}
+
+	cek, headers, err := ctx.keyGenerator.genKey()
+	if err != nil {
+		return nil, err
+	}
+
+	obj.protected.merge(&headers)
+
+	for i, info := range ctx.recipients {
+		recipient, err := info.keyEncrypter.encryptKey(cek, info.keyAlg)
+		if err != nil {
+			return nil, err
+		}
+
+		err = recipient.header.set(headerAlgorithm, info.keyAlg)
+		if err != nil {
+			return nil, err
+		}
+
+		if info.keyID != "" {
+			err = recipient.header.set(headerKeyID, info.keyID)
+			if err != nil {
+				return nil, err
+			}
+		}
+		obj.recipients[i] = recipient
+	}
+
+	if len(ctx.recipients) == 1 {
+		// Move per-recipient headers into main protected header if there's
+		// only a single recipient.
+		obj.protected.merge(obj.recipients[0].header)
+		obj.recipients[0].header = nil
+	}
+
+	if ctx.compressionAlg != NONE {
+		plaintext, err = compress(ctx.compressionAlg, plaintext)
+		if err != nil {
+			return nil, err
+		}
+
+		err = obj.protected.set(headerCompression, ctx.compressionAlg)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	for k, v := range ctx.extraHeaders {
+		b, err := json.Marshal(v)
+		if err != nil {
+			return nil, err
+		}
+		(*obj.protected)[k] = makeRawMessage(b)
+	}
+
+	authData := obj.computeAuthData()
+	parts, err := ctx.cipher.encrypt(cek, authData, plaintext)
+	if err != nil {
+		return nil, err
+	}
+
+	obj.iv = parts.iv
+	obj.ciphertext = parts.ciphertext
+	obj.tag = parts.tag
+
+	return obj, nil
+}
+
+func (ctx *genericEncrypter) Options() EncrypterOptions {
+	return EncrypterOptions{
+		Compression:  ctx.compressionAlg,
+		ExtraHeaders: ctx.extraHeaders,
+	}
+}
+
+// Decrypt and validate the object and return the plaintext. Note that this
+// function does not support multi-recipient, if you desire multi-recipient
+// decryption use DecryptMulti instead.
+func (obj JSONWebEncryption) Decrypt(decryptionKey interface{}) ([]byte, error) {
+	headers := obj.mergedHeaders(nil)
+
+	if len(obj.recipients) > 1 {
+		return nil, errors.New("square/go-jose: too many recipients in payload; expecting only one")
+	}
+
+	critical, err := headers.getCritical()
+	if err != nil {
+		return nil, fmt.Errorf("square/go-jose: invalid crit header")
+	}
+
+	if len(critical) > 0 {
+		return nil, fmt.Errorf("square/go-jose: unsupported crit header")
+	}
+
+	decrypter, err := newDecrypter(decryptionKey)
+	if err != nil {
+		return nil, err
+	}
+
+	cipher := getContentCipher(headers.getEncryption())
+	if cipher == nil {
+		return nil, fmt.Errorf("square/go-jose: unsupported enc value '%s'", string(headers.getEncryption()))
+	}
+
+	generator := randomKeyGenerator{
+		size: cipher.keySize(),
+	}
+
+	parts := &aeadParts{
+		iv:         obj.iv,
+		ciphertext: obj.ciphertext,
+		tag:        obj.tag,
+	}
+
+	authData := obj.computeAuthData()
+
+	var plaintext []byte
+	recipient := obj.recipients[0]
+	recipientHeaders := obj.mergedHeaders(&recipient)
+
+	cek, err := decrypter.decryptKey(recipientHeaders, &recipient, generator)
+	if err == nil {
+		// Found a valid CEK -- let's try to decrypt.
+		plaintext, err = cipher.decrypt(cek, authData, parts)
+	}
+
+	if plaintext == nil {
+		return nil, ErrCryptoFailure
+	}
+
+	// The "zip" header parameter may only be present in the protected header.
+	if comp := obj.protected.getCompression(); comp != "" {
+		plaintext, err = decompress(comp, plaintext)
+	}
+
+	return plaintext, err
+}
+
+// DecryptMulti decrypts and validates the object and returns the plaintexts,
+// with support for multiple recipients. It returns the index of the recipient
+// for which the decryption was successful, the merged headers for that recipient,
+// and the plaintext.
+func (obj JSONWebEncryption) DecryptMulti(decryptionKey interface{}) (int, Header, []byte, error) {
+	globalHeaders := obj.mergedHeaders(nil)
+
+	critical, err := globalHeaders.getCritical()
+	if err != nil {
+		return -1, Header{}, nil, fmt.Errorf("square/go-jose: invalid crit header")
+	}
+
+	if len(critical) > 0 {
+		return -1, Header{}, nil, fmt.Errorf("square/go-jose: unsupported crit header")
+	}
+
+	decrypter, err := newDecrypter(decryptionKey)
+	if err != nil {
+		return -1, Header{}, nil, err
+	}
+
+	encryption := globalHeaders.getEncryption()
+	cipher := getContentCipher(encryption)
+	if cipher == nil {
+		return -1, Header{}, nil, fmt.Errorf("square/go-jose: unsupported enc value '%s'", string(encryption))
+	}
+
+	generator := randomKeyGenerator{
+		size: cipher.keySize(),
+	}
+
+	parts := &aeadParts{
+		iv:         obj.iv,
+		ciphertext: obj.ciphertext,
+		tag:        obj.tag,
+	}
+
+	authData := obj.computeAuthData()
+
+	index := -1
+	var plaintext []byte
+	var headers rawHeader
+
+	for i, recipient := range obj.recipients {
+		recipientHeaders := obj.mergedHeaders(&recipient)
+
+		cek, err := decrypter.decryptKey(recipientHeaders, &recipient, generator)
+		if err == nil {
+			// Found a valid CEK -- let's try to decrypt.
+			plaintext, err = cipher.decrypt(cek, authData, parts)
+			if err == nil {
+				index = i
+				headers = recipientHeaders
+				break
+			}
+		}
+	}
+
+	if plaintext == nil || err != nil {
+		return -1, Header{}, nil, ErrCryptoFailure
+	}
+
+	// The "zip" header parameter may only be present in the protected header.
+	if comp := obj.protected.getCompression(); comp != "" {
+		plaintext, err = decompress(comp, plaintext)
+	}
+
+	sanitized, err := headers.sanitized()
+	if err != nil {
+		return -1, Header{}, nil, fmt.Errorf("square/go-jose: failed to sanitize header: %v", err)
+	}
+
+	return index, sanitized, plaintext, err
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/crypter_test.go b/vendor/gopkg.in/square/go-jose.v2/crypter_test.go
new file mode 100644
index 0000000..604f124
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/crypter_test.go
@@ -0,0 +1,1070 @@
+/*-
+ * Copyright 2014 Square Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package jose
+
+import (
+	"bytes"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/rsa"
+	"fmt"
+	"io"
+	"math/big"
+	"reflect"
+	"regexp"
+	"testing"
+
+	"golang.org/x/crypto/ed25519"
+)
+
+// We generate only a single RSA and EC key for testing, speeds up tests.
+var rsaTestKey, _ = rsa.GenerateKey(rand.Reader, 2048)
+
+var ecTestKey256, _ = ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+var ecTestKey384, _ = ecdsa.GenerateKey(elliptic.P384(), rand.Reader)
+var ecTestKey521, _ = ecdsa.GenerateKey(elliptic.P521(), rand.Reader)
+
+var ed25519PublicKey, ed25519PrivateKey, _ = ed25519.GenerateKey(rand.Reader)
+
+func RoundtripJWE(keyAlg KeyAlgorithm, encAlg ContentEncryption, compressionAlg CompressionAlgorithm, serializer func(*JSONWebEncryption) (string, error), corrupter func(*JSONWebEncryption) bool, aad []byte, encryptionKey interface{}, decryptionKey interface{}) error {
+	var rcpt Recipient
+	switch keyAlg {
+	case PBES2_HS256_A128KW, PBES2_HS384_A192KW, PBES2_HS512_A256KW:
+		// use 1k iterations instead of 100k to reduce computational cost
+		rcpt = Recipient{Algorithm: keyAlg, Key: encryptionKey, PBES2Count: 1000}
+	default:
+		rcpt = Recipient{Algorithm: keyAlg, Key: encryptionKey}
+	}
+	enc, err := NewEncrypter(encAlg, rcpt, &EncrypterOptions{Compression: compressionAlg})
+	if err != nil {
+		return fmt.Errorf("error on new encrypter: %s", err)
+	}
+
+	input := []byte("Lorem ipsum dolor sit amet")
+	obj, err := enc.EncryptWithAuthData(input, aad)
+	if err != nil {
+		return fmt.Errorf("error in encrypt: %s", err)
+	}
+
+	msg, err := serializer(obj)
+	if err != nil {
+		return fmt.Errorf("error in serializer: %s", err)
+	}
+
+	parsed, err := ParseEncrypted(msg)
+	if err != nil {
+		return fmt.Errorf("error in parse: %s, on msg '%s'", err, msg)
+	}
+
+	// (Maybe) mangle object
+	skip := corrupter(parsed)
+	if skip {
+		return fmt.Errorf("corrupter indicated message should be skipped")
+	}
+
+	if bytes.Compare(parsed.GetAuthData(), aad) != 0 {
+		return fmt.Errorf("auth data in parsed object does not match")
+	}
+
+	output, err := parsed.Decrypt(decryptionKey)
+	if err != nil {
+		return fmt.Errorf("error on decrypt: %s", err)
+	}
+
+	if bytes.Compare(input, output) != 0 {
+		return fmt.Errorf("Decrypted output does not match input, got '%s' but wanted '%s'", output, input)
+	}
+
+	return nil
+}
+
+func TestRoundtripsJWE(t *testing.T) {
+	// Test matrix
+	keyAlgs := []KeyAlgorithm{
+		DIRECT, ECDH_ES, ECDH_ES_A128KW, ECDH_ES_A192KW, ECDH_ES_A256KW, A128KW, A192KW, A256KW,
+		RSA1_5, RSA_OAEP, RSA_OAEP_256, A128GCMKW, A192GCMKW, A256GCMKW,
+		PBES2_HS256_A128KW, PBES2_HS384_A192KW, PBES2_HS512_A256KW,
+	}
+	encAlgs := []ContentEncryption{A128GCM, A192GCM, A256GCM, A128CBC_HS256, A192CBC_HS384, A256CBC_HS512}
+	zipAlgs := []CompressionAlgorithm{NONE, DEFLATE}
+
+	serializers := []func(*JSONWebEncryption) (string, error){
+		func(obj *JSONWebEncryption) (string, error) { return obj.CompactSerialize() },
+		func(obj *JSONWebEncryption) (string, error) { return obj.FullSerialize(), nil },
+	}
+
+	corrupter := func(obj *JSONWebEncryption) bool { return false }
+
+	// Note: can't use AAD with compact serialization
+	aads := [][]byte{
+		nil,
+		[]byte("Ut enim ad minim veniam"),
+	}
+
+	// Test all different configurations
+	for _, alg := range keyAlgs {
+		for _, enc := range encAlgs {
+			for _, key := range generateTestKeys(alg, enc) {
+				for _, zip := range zipAlgs {
+					for i, serializer := range serializers {
+						err := RoundtripJWE(alg, enc, zip, serializer, corrupter, aads[i], key.enc, key.dec)
+						if err != nil {
+							t.Error(err, alg, enc, zip, i)
+						}
+					}
+				}
+			}
+		}
+	}
+}
+
+func TestRoundtripsJWECorrupted(t *testing.T) {
+	// Test matrix
+	keyAlgs := []KeyAlgorithm{DIRECT, ECDH_ES, ECDH_ES_A128KW, A128KW, RSA1_5, RSA_OAEP, RSA_OAEP_256, A128GCMKW, PBES2_HS256_A128KW}
+	encAlgs := []ContentEncryption{A128GCM, A192GCM, A256GCM, A128CBC_HS256, A192CBC_HS384, A256CBC_HS512}
+	zipAlgs := []CompressionAlgorithm{NONE, DEFLATE}
+
+	serializers := []func(*JSONWebEncryption) (string, error){
+		func(obj *JSONWebEncryption) (string, error) { return obj.CompactSerialize() },
+		func(obj *JSONWebEncryption) (string, error) { return obj.FullSerialize(), nil },
+	}
+
+	bitflip := func(slice []byte) bool {
+		if len(slice) > 0 {
+			slice[0] ^= 0xFF
+			return false
+		}
+		return true
+	}
+
+	corrupters := []func(*JSONWebEncryption) bool{
+		func(obj *JSONWebEncryption) bool {
+			// Set invalid ciphertext
+			return bitflip(obj.ciphertext)
+		},
+		func(obj *JSONWebEncryption) bool {
+			// Set invalid auth tag
+			return bitflip(obj.tag)
+		},
+		func(obj *JSONWebEncryption) bool {
+			// Set invalid AAD
+			return bitflip(obj.aad)
+		},
+		func(obj *JSONWebEncryption) bool {
+			// Mess with encrypted key
+			return bitflip(obj.recipients[0].encryptedKey)
+		},
+		func(obj *JSONWebEncryption) bool {
+			// Mess with GCM-KW auth tag
+			tag, _ := obj.protected.getTag()
+			skip := bitflip(tag.bytes())
+			if skip {
+				return true
+			}
+			obj.protected.set(headerTag, tag)
+			return false
+		},
+	}
+
+	// Note: can't use AAD with compact serialization
+	aads := [][]byte{
+		nil,
+		[]byte("Ut enim ad minim veniam"),
+	}
+
+	// Test all different configurations
+	for _, alg := range keyAlgs {
+		for _, enc := range encAlgs {
+			for _, key := range generateTestKeys(alg, enc) {
+				for _, zip := range zipAlgs {
+					for i, serializer := range serializers {
+						for j, corrupter := range corrupters {
+							err := RoundtripJWE(alg, enc, zip, serializer, corrupter, aads[i], key.enc, key.dec)
+							if err == nil {
+								t.Error("failed to detect corrupt data", err, alg, enc, zip, i, j)
+							}
+						}
+					}
+				}
+			}
+		}
+	}
+}
+
+func TestEncrypterWithJWKAndKeyID(t *testing.T) {
+	enc, err := NewEncrypter(A128GCM, Recipient{Algorithm: A128KW, Key: &JSONWebKey{
+		KeyID: "test-id",
+		Key:   []byte{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15},
+	}}, nil)
+	if err != nil {
+		t.Error(err)
+	}
+
+	ciphertext, _ := enc.Encrypt([]byte("Lorem ipsum dolor sit amet"))
+
+	serialized1, _ := ciphertext.CompactSerialize()
+	serialized2 := ciphertext.FullSerialize()
+
+	parsed1, _ := ParseEncrypted(serialized1)
+	parsed2, _ := ParseEncrypted(serialized2)
+
+	if parsed1.Header.KeyID != "test-id" {
+		t.Errorf("expected message to have key id from JWK, but found '%s' instead", parsed1.Header.KeyID)
+	}
+	if parsed2.Header.KeyID != "test-id" {
+		t.Errorf("expected message to have key id from JWK, but found '%s' instead", parsed2.Header.KeyID)
+	}
+}
+
+func TestEncrypterWithBrokenRand(t *testing.T) {
+	keyAlgs := []KeyAlgorithm{ECDH_ES_A128KW, A128KW, RSA1_5, RSA_OAEP, RSA_OAEP_256, A128GCMKW, PBES2_HS256_A128KW}
+	encAlgs := []ContentEncryption{A128GCM, A192GCM, A256GCM, A128CBC_HS256, A192CBC_HS384, A256CBC_HS512}
+
+	serializer := func(obj *JSONWebEncryption) (string, error) { return obj.CompactSerialize() }
+	corrupter := func(obj *JSONWebEncryption) bool { return false }
+
+	// Break rand reader
+	readers := []func() io.Reader{
+		// Totally broken
+		func() io.Reader { return bytes.NewReader([]byte{}) },
+		// Not enough bytes
+		func() io.Reader { return io.LimitReader(rand.Reader, 20) },
+	}
+
+	defer resetRandReader()
+
+	for _, alg := range keyAlgs {
+		for _, enc := range encAlgs {
+			for _, key := range generateTestKeys(alg, enc) {
+				for i, getReader := range readers {
+					RandReader = getReader()
+					err := RoundtripJWE(alg, enc, NONE, serializer, corrupter, nil, key.enc, key.dec)
+					if err == nil {
+						t.Error("encrypter should fail if rand is broken", i)
+					}
+				}
+			}
+		}
+	}
+}
+
+func TestNewEncrypterErrors(t *testing.T) {
+	_, err := NewEncrypter("XYZ", Recipient{}, nil)
+	if err == nil {
+		t.Error("was able to instantiate encrypter with invalid cipher")
+	}
+
+	_, err = NewMultiEncrypter("XYZ", []Recipient{}, nil)
+	if err == nil {
+		t.Error("was able to instantiate multi-encrypter with invalid cipher")
+	}
+
+	_, err = NewEncrypter(A128GCM, Recipient{Algorithm: DIRECT, Key: nil}, nil)
+	if err == nil {
+		t.Error("was able to instantiate encrypter with invalid direct key")
+	}
+
+	_, err = NewEncrypter(A128GCM, Recipient{Algorithm: ECDH_ES, Key: nil}, nil)
+	if err == nil {
+		t.Error("was able to instantiate encrypter with invalid EC key")
+	}
+}
+
+func TestMultiRecipientJWE(t *testing.T) {
+	sharedKey := []byte{
+		0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15,
+		0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15,
+	}
+
+	enc, err := NewMultiEncrypter(A128GCM, []Recipient{
+		{Algorithm: RSA_OAEP, Key: &rsaTestKey.PublicKey},
+		{Algorithm: A256GCMKW, Key: sharedKey},
+	}, nil)
+	if err != nil {
+		panic(err)
+	}
+
+	input := []byte("Lorem ipsum dolor sit amet")
+	obj, err := enc.Encrypt(input)
+	if err != nil {
+		t.Fatal("error in encrypt: ", err)
+	}
+
+	msg := obj.FullSerialize()
+
+	parsed, err := ParseEncrypted(msg)
+	if err != nil {
+		t.Fatal("error in parse: ", err)
+	}
+
+	i, _, output, err := parsed.DecryptMulti(rsaTestKey)
+	if err != nil {
+		t.Fatal("error on decrypt with RSA: ", err)
+	}
+
+	if i != 0 {
+		t.Fatal("recipient index should be 0 for RSA key")
+	}
+
+	if bytes.Compare(input, output) != 0 {
+		t.Fatal("Decrypted output does not match input: ", output, input)
+	}
+
+	i, _, output, err = parsed.DecryptMulti(sharedKey)
+	if err != nil {
+		t.Fatal("error on decrypt with AES: ", err)
+	}
+
+	if i != 1 {
+		t.Fatal("recipient index should be 1 for shared key")
+	}
+
+	if bytes.Compare(input, output) != 0 {
+		t.Fatal("Decrypted output does not match input", output, input)
+	}
+}
+
+func TestMultiRecipientErrors(t *testing.T) {
+	_, err := NewMultiEncrypter(A128GCM, []Recipient{}, nil)
+	if err == nil {
+		t.Error("should fail to instantiate with zero recipients")
+	}
+}
+
+func TestEncrypterOptions(t *testing.T) {
+	sharedKey := []byte{
+		0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15,
+		0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15,
+	}
+
+	opts := &EncrypterOptions{
+		Compression: DEFLATE,
+	}
+	opts.WithType("JWT")
+	opts.WithContentType("JWT")
+	enc, err := NewEncrypter(A256GCM, Recipient{Algorithm: A256GCMKW, Key: sharedKey}, opts)
+	if err != nil {
+		fmt.Println(err)
+		t.Error("Failed to create encrypter")
+	}
+
+	if !reflect.DeepEqual(*opts, enc.Options()) {
+		t.Error("Encrypter options do not match")
+	}
+}
+
+// Test that extra headers are generated and parsed in a round trip.
+func TestEncrypterExtraHeaderInclusion(t *testing.T) {
+	sharedKey := []byte{
+		0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15,
+		0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15,
+	}
+
+	opts := &EncrypterOptions{
+		Compression: DEFLATE,
+	}
+	opts.WithType("JWT")
+	opts.WithContentType("JWT")
+	opts.WithHeader(HeaderKey("myCustomHeader"), "xyz")
+	enc, err := NewEncrypter(A256GCM, Recipient{Algorithm: A256GCMKW, Key: sharedKey}, opts)
+	if err != nil {
+		fmt.Println(err)
+		t.Error("Failed to create encrypter")
+	}
+
+	if !reflect.DeepEqual(*opts, enc.Options()) {
+		t.Error("Encrypter options do not match")
+	}
+
+	input := []byte("Lorem ipsum dolor sit amet")
+	obj, err := enc.Encrypt(input)
+	if err != nil {
+		t.Fatal("error in encrypt: ", err)
+	}
+
+	parsed, err := ParseEncrypted(obj.FullSerialize())
+	if err != nil {
+		t.Fatal("error in parse: ", err)
+	}
+
+	output, err := parsed.Decrypt(sharedKey)
+	if err != nil {
+		t.Fatal("error on decrypt: ", err)
+	}
+
+	if bytes.Compare(input, output) != 0 {
+		t.Fatal("Decrypted output does not match input: ", output, input)
+	}
+
+	if parsed.Header.ExtraHeaders[HeaderType] != "JWT" ||
+		parsed.Header.ExtraHeaders[HeaderContentType] != "JWT" ||
+		parsed.Header.ExtraHeaders[HeaderKey("myCustomHeader")] != "xyz" {
+		t.Fatalf("Mismatch in extra headers: %#v", parsed.Header.ExtraHeaders)
+	}
+}
+
+// TestPBES2JWKEncryption uses the plaintext and serialization reference of
+// JWK RFC https://tools.ietf.org/html/rfc7517#appendix-C.4
+func TestPBES2JWKEncryption(t *testing.T) {
+	passphrase := []byte("Thus from my lips, by yours, my sin is purged.")
+
+	plaintext := []byte(`{
+      "kty":"RSA",
+      "kid":"juliet@capulet.lit",
+      "use":"enc",
+      "n":"t6Q8PWSi1dkJj9hTP8hNYFlvadM7DflW9mWepOJhJ66w7nyoK1gPNqFMSQRy
+           O125Gp-TEkodhWr0iujjHVx7BcV0llS4w5ACGgPrcAd6ZcSR0-Iqom-QFcNP
+           8Sjg086MwoqQU_LYywlAGZ21WSdS_PERyGFiNnj3QQlO8Yns5jCtLCRwLHL0
+           Pb1fEv45AuRIuUfVcPySBWYnDyGxvjYGDSM-AqWS9zIQ2ZilgT-GqUmipg0X
+           OC0Cc20rgLe2ymLHjpHciCKVAbY5-L32-lSeZO-Os6U15_aXrk9Gw8cPUaX1
+           _I8sLGuSiVdt3C_Fn2PZ3Z8i744FPFGGcG1qs2Wz-Q",
+      "e":"AQAB",
+      "d":"GRtbIQmhOZtyszfgKdg4u_N-R_mZGU_9k7JQ_jn1DnfTuMdSNprTeaSTyWfS
+           NkuaAwnOEbIQVy1IQbWVV25NY3ybc_IhUJtfri7bAXYEReWaCl3hdlPKXy9U
+           vqPYGR0kIXTQRqns-dVJ7jahlI7LyckrpTmrM8dWBo4_PMaenNnPiQgO0xnu
+           ToxutRZJfJvG4Ox4ka3GORQd9CsCZ2vsUDmsXOfUENOyMqADC6p1M3h33tsu
+           rY15k9qMSpG9OX_IJAXmxzAh_tWiZOwk2K4yxH9tS3Lq1yX8C1EWmeRDkK2a
+           hecG85-oLKQt5VEpWHKmjOi_gJSdSgqcN96X52esAQ",
+      "p":"2rnSOV4hKSN8sS4CgcQHFbs08XboFDqKum3sc4h3GRxrTmQdl1ZK9uw-PIHf
+           QP0FkxXVrx-WE-ZEbrqivH_2iCLUS7wAl6XvARt1KkIaUxPPSYB9yk31s0Q8
+           UK96E3_OrADAYtAJs-M3JxCLfNgqh56HDnETTQhH3rCT5T3yJws",
+      "q":"1u_RiFDP7LBYh3N4GXLT9OpSKYP0uQZyiaZwBtOCBNJgQxaj10RWjsZu0c6I
+           edis4S7B_coSKB0Kj9PaPaBzg-IySRvvcQuPamQu66riMhjVtG6TlV8CLCYK
+           rYl52ziqK0E_ym2QnkwsUX7eYTB7LbAHRK9GqocDE5B0f808I4s",
+      "dp":"KkMTWqBUefVwZ2_Dbj1pPQqyHSHjj90L5x_MOzqYAJMcLMZtbUtwKqvVDq3
+           tbEo3ZIcohbDtt6SbfmWzggabpQxNxuBpoOOf_a_HgMXK_lhqigI4y_kqS1w
+           Y52IwjUn5rgRrJ-yYo1h41KR-vz2pYhEAeYrhttWtxVqLCRViD6c",
+      "dq":"AvfS0-gRxvn0bwJoMSnFxYcK1WnuEjQFluMGfwGitQBWtfZ1Er7t1xDkbN9
+           GQTB9yqpDoYaN06H7CFtrkxhJIBQaj6nkF5KKS3TQtQ5qCzkOkmxIe3KRbBy
+           mXxkb5qwUpX5ELD5xFc6FeiafWYY63TmmEAu_lRFCOJ3xDea-ots",
+      "qi":"lSQi-w9CpyUReMErP1RsBLk7wNtOvs5EQpPqmuMvqW57NBUczScEoPwmUqq
+           abu9V0-Py4dQ57_bapoKRu1R90bvuFnU63SHWEFglZQvJDMeAvmj4sm-Fp0o
+           Yu_neotgQ0hzbI5gry7ajdYy9-2lNx_76aBZoOUu9HCJ-UsfSOI8"
+     }`)
+
+	serializationReference := `
+	  eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJwMnMiOiIyV0NUY0paMVJ2ZF9DSn
+	  VKcmlwUTF3IiwicDJjIjo0MDk2LCJlbmMiOiJBMTI4Q0JDLUhTMjU2IiwiY3R5Ijoi
+	  andrK2pzb24ifQ.
+	  TrqXOwuNUfDV9VPTNbyGvEJ9JMjefAVn-TR1uIxR9p6hsRQh9Tk7BA.
+	  Ye9j1qs22DmRSAddIh-VnA.
+	  AwhB8lxrlKjFn02LGWEqg27H4Tg9fyZAbFv3p5ZicHpj64QyHC44qqlZ3JEmnZTgQo
+	  wIqZJ13jbyHB8LgePiqUJ1hf6M2HPLgzw8L-mEeQ0jvDUTrE07NtOerBk8bwBQyZ6g
+	  0kQ3DEOIglfYxV8-FJvNBYwbqN1Bck6d_i7OtjSHV-8DIrp-3JcRIe05YKy3Oi34Z_
+	  GOiAc1EK21B11c_AE11PII_wvvtRiUiG8YofQXakWd1_O98Kap-UgmyWPfreUJ3lJP
+	  nbD4Ve95owEfMGLOPflo2MnjaTDCwQokoJ_xplQ2vNPz8iguLcHBoKllyQFJL2mOWB
+	  wqhBo9Oj-O800as5mmLsvQMTflIrIEbbTMzHMBZ8EFW9fWwwFu0DWQJGkMNhmBZQ-3
+	  lvqTc-M6-gWA6D8PDhONfP2Oib2HGizwG1iEaX8GRyUpfLuljCLIe1DkGOewhKuKkZ
+	  h04DKNM5Nbugf2atmU9OP0Ldx5peCUtRG1gMVl7Qup5ZXHTjgPDr5b2N731UooCGAU
+	  qHdgGhg0JVJ_ObCTdjsH4CF1SJsdUhrXvYx3HJh2Xd7CwJRzU_3Y1GxYU6-s3GFPbi
+	  rfqqEipJDBTHpcoCmyrwYjYHFgnlqBZRotRrS95g8F95bRXqsaDY7UgQGwBQBwy665
+	  d0zpvTasvfXf_c0MWAl-neFaKOW_Px6g4EUDjG1GWSXV9cLStLw_0ovdApDIFLHYHe
+	  PyagyHjouQUuGiq7BsYwYrwaF06tgB8hV8omLNfMEmDPJaZUzMuHw6tBDwGkzD-tS_
+	  ub9hxrpJ4UsOWnt5rGUyoN2N_c1-TQlXxm5oto14MxnoAyBQBpwIEgSH3Y4ZhwKBhH
+	  PjSo0cdwuNdYbGPpb-YUvF-2NZzODiQ1OvWQBRHSbPWYz_xbGkgD504LRtqRwCO7CC
+	  _CyyURi1sEssPVsMJRX_U4LFEOc82TiDdqjKOjRUfKK5rqLi8nBE9soQ0DSaOoFQZi
+	  GrBrqxDsNYiAYAmxxkos-i3nX4qtByVx85sCE5U_0MqG7COxZWMOPEFrDaepUV-cOy
+	  rvoUIng8i8ljKBKxETY2BgPegKBYCxsAUcAkKamSCC9AiBxA0UOHyhTqtlvMksO7AE
+	  hNC2-YzPyx1FkhMoS4LLe6E_pFsMlmjA6P1NSge9C5G5tETYXGAn6b1xZbHtmwrPSc
+	  ro9LWhVmAaA7_bxYObnFUxgWtK4vzzQBjZJ36UTk4OTB-JvKWgfVWCFsaw5WCHj6Oo
+	  4jpO7d2yN7WMfAj2hTEabz9wumQ0TMhBduZ-QON3pYObSy7TSC1vVme0NJrwF_cJRe
+	  hKTFmdlXGVldPxZCplr7ZQqRQhF8JP-l4mEQVnCaWGn9ONHlemczGOS-A-wwtnmwjI
+	  B1V_vgJRf4FdpV-4hUk4-QLpu3-1lWFxrtZKcggq3tWTduRo5_QebQbUUT_VSCgsFc
+	  OmyWKoj56lbxthN19hq1XGWbLGfrrR6MWh23vk01zn8FVwi7uFwEnRYSafsnWLa1Z5
+	  TpBj9GvAdl2H9NHwzpB5NqHpZNkQ3NMDj13Fn8fzO0JB83Etbm_tnFQfcb13X3bJ15
+	  Cz-Ww1MGhvIpGGnMBT_ADp9xSIyAM9dQ1yeVXk-AIgWBUlN5uyWSGyCxp0cJwx7HxM
+	  38z0UIeBu-MytL-eqndM7LxytsVzCbjOTSVRmhYEMIzUAnS1gs7uMQAGRdgRIElTJE
+	  SGMjb_4bZq9s6Ve1LKkSi0_QDsrABaLe55UY0zF4ZSfOV5PMyPtocwV_dcNPlxLgNA
+	  D1BFX_Z9kAdMZQW6fAmsfFle0zAoMe4l9pMESH0JB4sJGdCKtQXj1cXNydDYozF7l8
+	  H00BV_Er7zd6VtIw0MxwkFCTatsv_R-GsBCH218RgVPsfYhwVuT8R4HarpzsDBufC4
+	  r8_c8fc9Z278sQ081jFjOja6L2x0N_ImzFNXU6xwO-Ska-QeuvYZ3X_L31ZOX4Llp-
+	  7QSfgDoHnOxFv1Xws-D5mDHD3zxOup2b2TppdKTZb9eW2vxUVviM8OI9atBfPKMGAO
+	  v9omA-6vv5IxUH0-lWMiHLQ_g8vnswp-Jav0c4t6URVUzujNOoNd_CBGGVnHiJTCHl
+	  88LQxsqLHHIu4Fz-U2SGnlxGTj0-ihit2ELGRv4vO8E1BosTmf0cx3qgG0Pq0eOLBD
+	  IHsrdZ_CCAiTc0HVkMbyq1M6qEhM-q5P6y1QCIrwg.
+	  0HFmhOzsQ98nNWJjIHkR7A`
+
+	// remove white spaces and line breaks
+	r := regexp.MustCompile(`\s`)
+	plaintext = r.ReplaceAll(plaintext, []byte(""))
+	serializationReference = r.ReplaceAllString(serializationReference, "")
+
+	rcpt := Recipient{
+		Algorithm:  PBES2_HS256_A128KW,
+		Key:        passphrase,
+		PBES2Count: 4096,
+		PBES2Salt: []byte{
+			217, 96, 147, 112, 150, 117, 70,
+			247, 127, 8, 155, 137, 174, 42, 80, 215,
+		},
+	}
+
+	enc, err := NewEncrypter(A128CBC_HS256, rcpt, nil)
+	if err != nil {
+		t.Fatal("error on NewEncrypter:", err)
+	}
+
+	obj, err := enc.Encrypt(plaintext)
+	if err != nil {
+		t.Fatal("error on new Encrypt:", err)
+	}
+
+	serialized, err := obj.CompactSerialize()
+	if err != nil {
+		t.Fatal("error on CompactSerialize")
+	}
+
+	jwe1, err := ParseEncrypted(serialized)
+	if err != nil {
+		t.Fatal("error in ParseEncrypted")
+	}
+
+	jwe2, err := ParseEncrypted(serializationReference)
+	if err != nil {
+		t.Fatal("error in ParseEncrypted")
+	}
+
+	original1, err := jwe1.Decrypt(passphrase)
+	if err != nil {
+		t.Fatal("error in Decrypt:", err)
+	}
+
+	original2, err := jwe2.Decrypt(passphrase)
+	if err != nil {
+		t.Fatal("error in Decrypt reference:", err)
+	}
+
+	if bytes.Compare(original1, original2) != 0 {
+		t.Error("decryption does not match reference decryption")
+	}
+
+	if bytes.Compare(plaintext, original1) != 0 {
+		t.Error("decryption does not match plaintext")
+	}
+
+	if bytes.Compare(plaintext, original2) != 0 {
+		t.Error("reference decryption does not match plaintext")
+	}
+}
+
+func TestEncrypterWithPBES2(t *testing.T) {
+	expected := []byte("Lorem ipsum dolor sit amet")
+	algs := []KeyAlgorithm{
+		PBES2_HS256_A128KW, PBES2_HS384_A192KW, PBES2_HS512_A256KW,
+	}
+
+	// Check with both strings and []byte
+	recipientKeys := []interface{}{"password", []byte("password")}
+	for _, key := range recipientKeys {
+		for _, alg := range algs {
+			enc, err := NewEncrypter(A128GCM, Recipient{Algorithm: alg, Key: &JSONWebKey{
+				KeyID: "test-id",
+				Key:   key,
+			}}, nil)
+			if err != nil {
+				t.Error(err)
+			}
+
+			ciphertext, _ := enc.Encrypt(expected)
+
+			serialized1, _ := ciphertext.CompactSerialize()
+			serialized2 := ciphertext.FullSerialize()
+
+			parsed1, _ := ParseEncrypted(serialized1)
+			parsed2, _ := ParseEncrypted(serialized2)
+
+			actual1, err := parsed1.Decrypt("password")
+			if err != nil {
+				t.Fatal("error on Decrypt:", err)
+			}
+
+			actual2, err := parsed2.Decrypt([]byte("password"))
+			if err != nil {
+				t.Fatal("error on Decrypt:", err)
+			}
+
+			if bytes.Compare(actual1, expected) != 0 {
+				t.Errorf("error comparing decrypted message (%s) and expected (%s)", actual1, expected)
+			}
+
+			if bytes.Compare(actual2, expected) != 0 {
+				t.Errorf("error comparing decrypted message (%s) and expected (%s)", actual2, expected)
+			}
+		}
+	}
+}
+
+type testKey struct {
+	enc, dec interface{}
+}
+
+func symmetricTestKey(size int) []testKey {
+	key, _, _ := randomKeyGenerator{size: size}.genKey()
+
+	return []testKey{
+		{
+			enc: key,
+			dec: key,
+		},
+		{
+			enc: &JSONWebKey{KeyID: "test", Key: key},
+			dec: &JSONWebKey{KeyID: "test", Key: key},
+		},
+	}
+}
+
+func TestDirectEncryptionKeySizeCheck(t *testing.T) {
+	// 16-byte key
+	key16 := []byte("0123456789ABCDEF")
+
+	// 32-byte key
+	key32 := []byte("0123456789ABCDEF0123456789ABCDEF")
+
+	// AES-128 with 32-byte key should reject
+	_, err := NewEncrypter(A128GCM, Recipient{Algorithm: DIRECT, Key: key32}, nil)
+	if err != ErrInvalidKeySize {
+		t.Error("Should reject AES-128 with 32-byte key")
+	}
+
+	// AES-256 with 16-byte key should reject
+	_, err = NewEncrypter(A256GCM, Recipient{Algorithm: DIRECT, Key: key16}, nil)
+	if err != ErrInvalidKeySize {
+		t.Error("Should reject AES-256 with 16-byte key")
+	}
+}
+
+func generateTestKeys(keyAlg KeyAlgorithm, encAlg ContentEncryption) []testKey {
+	switch keyAlg {
+	case DIRECT:
+		return symmetricTestKey(getContentCipher(encAlg).keySize())
+	case ECDH_ES, ECDH_ES_A128KW, ECDH_ES_A192KW, ECDH_ES_A256KW:
+		return []testKey{
+			{
+				dec: ecTestKey256,
+				enc: &ecTestKey256.PublicKey,
+			},
+			{
+				dec: ecTestKey384,
+				enc: &ecTestKey384.PublicKey,
+			},
+			{
+				dec: ecTestKey521,
+				enc: &ecTestKey521.PublicKey,
+			},
+			{
+				dec: &JSONWebKey{KeyID: "test", Key: ecTestKey256},
+				enc: &JSONWebKey{KeyID: "test", Key: &ecTestKey256.PublicKey},
+			},
+		}
+	case A128GCMKW, A128KW:
+		return symmetricTestKey(16)
+	case A192GCMKW, A192KW:
+		return symmetricTestKey(24)
+	case A256GCMKW, A256KW:
+		return symmetricTestKey(32)
+	case RSA1_5, RSA_OAEP, RSA_OAEP_256:
+		return []testKey{{
+			dec: rsaTestKey,
+			enc: &rsaTestKey.PublicKey,
+		}}
+	case PBES2_HS256_A128KW, PBES2_HS384_A192KW, PBES2_HS512_A256KW:
+		// size does not matter, use random integer
+		i, err := rand.Int(rand.Reader, big.NewInt(64))
+		if err != nil {
+			panic(err)
+		}
+		return symmetricTestKey(int(i.Int64()))
+	}
+
+	panic("Must update test case")
+}
+
+func RunRoundtripsJWE(b *testing.B, alg KeyAlgorithm, enc ContentEncryption, zip CompressionAlgorithm, priv, pub interface{}) {
+	serializer := func(obj *JSONWebEncryption) (string, error) {
+		return obj.CompactSerialize()
+	}
+
+	corrupter := func(obj *JSONWebEncryption) bool { return false }
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		err := RoundtripJWE(alg, enc, zip, serializer, corrupter, nil, pub, priv)
+		if err != nil {
+			b.Error(err)
+		}
+	}
+}
+
+var (
+	chunks = map[string][]byte{
+		"1B":   make([]byte, 1),
+		"64B":  make([]byte, 64),
+		"1KB":  make([]byte, 1024),
+		"64KB": make([]byte, 65536),
+		"1MB":  make([]byte, 1048576),
+		"64MB": make([]byte, 67108864),
+	}
+
+	symKey16, _, _ = randomKeyGenerator{size: 16}.genKey()
+	symKey32, _, _ = randomKeyGenerator{size: 32}.genKey()
+	symKey64, _, _ = randomKeyGenerator{size: 64}.genKey()
+
+	encrypters = map[string]Encrypter{
+		"OAEPAndGCM":          mustEncrypter(RSA_OAEP, A128GCM, &rsaTestKey.PublicKey),
+		"PKCSAndGCM":          mustEncrypter(RSA1_5, A128GCM, &rsaTestKey.PublicKey),
+		"OAEPAndCBC":          mustEncrypter(RSA_OAEP, A128CBC_HS256, &rsaTestKey.PublicKey),
+		"PKCSAndCBC":          mustEncrypter(RSA1_5, A128CBC_HS256, &rsaTestKey.PublicKey),
+		"DirectGCM128":        mustEncrypter(DIRECT, A128GCM, symKey16),
+		"DirectCBC128":        mustEncrypter(DIRECT, A128CBC_HS256, symKey32),
+		"DirectGCM256":        mustEncrypter(DIRECT, A256GCM, symKey32),
+		"DirectCBC256":        mustEncrypter(DIRECT, A256CBC_HS512, symKey64),
+		"AESKWAndGCM128":      mustEncrypter(A128KW, A128GCM, symKey16),
+		"AESKWAndCBC256":      mustEncrypter(A256KW, A256GCM, symKey32),
+		"ECDHOnP256AndGCM128": mustEncrypter(ECDH_ES, A128GCM, &ecTestKey256.PublicKey),
+		"ECDHOnP384AndGCM128": mustEncrypter(ECDH_ES, A128GCM, &ecTestKey384.PublicKey),
+		"ECDHOnP521AndGCM128": mustEncrypter(ECDH_ES, A128GCM, &ecTestKey521.PublicKey),
+	}
+)
+
+func BenchmarkEncrypt1BWithOAEPAndGCM(b *testing.B)   { benchEncrypt("1B", "OAEPAndGCM", b) }
+func BenchmarkEncrypt64BWithOAEPAndGCM(b *testing.B)  { benchEncrypt("64B", "OAEPAndGCM", b) }
+func BenchmarkEncrypt1KBWithOAEPAndGCM(b *testing.B)  { benchEncrypt("1KB", "OAEPAndGCM", b) }
+func BenchmarkEncrypt64KBWithOAEPAndGCM(b *testing.B) { benchEncrypt("64KB", "OAEPAndGCM", b) }
+func BenchmarkEncrypt1MBWithOAEPAndGCM(b *testing.B)  { benchEncrypt("1MB", "OAEPAndGCM", b) }
+func BenchmarkEncrypt64MBWithOAEPAndGCM(b *testing.B) { benchEncrypt("64MB", "OAEPAndGCM", b) }
+
+func BenchmarkEncrypt1BWithPKCSAndGCM(b *testing.B)   { benchEncrypt("1B", "PKCSAndGCM", b) }
+func BenchmarkEncrypt64BWithPKCSAndGCM(b *testing.B)  { benchEncrypt("64B", "PKCSAndGCM", b) }
+func BenchmarkEncrypt1KBWithPKCSAndGCM(b *testing.B)  { benchEncrypt("1KB", "PKCSAndGCM", b) }
+func BenchmarkEncrypt64KBWithPKCSAndGCM(b *testing.B) { benchEncrypt("64KB", "PKCSAndGCM", b) }
+func BenchmarkEncrypt1MBWithPKCSAndGCM(b *testing.B)  { benchEncrypt("1MB", "PKCSAndGCM", b) }
+func BenchmarkEncrypt64MBWithPKCSAndGCM(b *testing.B) { benchEncrypt("64MB", "PKCSAndGCM", b) }
+
+func BenchmarkEncrypt1BWithOAEPAndCBC(b *testing.B)   { benchEncrypt("1B", "OAEPAndCBC", b) }
+func BenchmarkEncrypt64BWithOAEPAndCBC(b *testing.B)  { benchEncrypt("64B", "OAEPAndCBC", b) }
+func BenchmarkEncrypt1KBWithOAEPAndCBC(b *testing.B)  { benchEncrypt("1KB", "OAEPAndCBC", b) }
+func BenchmarkEncrypt64KBWithOAEPAndCBC(b *testing.B) { benchEncrypt("64KB", "OAEPAndCBC", b) }
+func BenchmarkEncrypt1MBWithOAEPAndCBC(b *testing.B)  { benchEncrypt("1MB", "OAEPAndCBC", b) }
+func BenchmarkEncrypt64MBWithOAEPAndCBC(b *testing.B) { benchEncrypt("64MB", "OAEPAndCBC", b) }
+
+func BenchmarkEncrypt1BWithPKCSAndCBC(b *testing.B)   { benchEncrypt("1B", "PKCSAndCBC", b) }
+func BenchmarkEncrypt64BWithPKCSAndCBC(b *testing.B)  { benchEncrypt("64B", "PKCSAndCBC", b) }
+func BenchmarkEncrypt1KBWithPKCSAndCBC(b *testing.B)  { benchEncrypt("1KB", "PKCSAndCBC", b) }
+func BenchmarkEncrypt64KBWithPKCSAndCBC(b *testing.B) { benchEncrypt("64KB", "PKCSAndCBC", b) }
+func BenchmarkEncrypt1MBWithPKCSAndCBC(b *testing.B)  { benchEncrypt("1MB", "PKCSAndCBC", b) }
+func BenchmarkEncrypt64MBWithPKCSAndCBC(b *testing.B) { benchEncrypt("64MB", "PKCSAndCBC", b) }
+
+func BenchmarkEncrypt1BWithDirectGCM128(b *testing.B)   { benchEncrypt("1B", "DirectGCM128", b) }
+func BenchmarkEncrypt64BWithDirectGCM128(b *testing.B)  { benchEncrypt("64B", "DirectGCM128", b) }
+func BenchmarkEncrypt1KBWithDirectGCM128(b *testing.B)  { benchEncrypt("1KB", "DirectGCM128", b) }
+func BenchmarkEncrypt64KBWithDirectGCM128(b *testing.B) { benchEncrypt("64KB", "DirectGCM128", b) }
+func BenchmarkEncrypt1MBWithDirectGCM128(b *testing.B)  { benchEncrypt("1MB", "DirectGCM128", b) }
+func BenchmarkEncrypt64MBWithDirectGCM128(b *testing.B) { benchEncrypt("64MB", "DirectGCM128", b) }
+
+func BenchmarkEncrypt1BWithDirectCBC128(b *testing.B)   { benchEncrypt("1B", "DirectCBC128", b) }
+func BenchmarkEncrypt64BWithDirectCBC128(b *testing.B)  { benchEncrypt("64B", "DirectCBC128", b) }
+func BenchmarkEncrypt1KBWithDirectCBC128(b *testing.B)  { benchEncrypt("1KB", "DirectCBC128", b) }
+func BenchmarkEncrypt64KBWithDirectCBC128(b *testing.B) { benchEncrypt("64KB", "DirectCBC128", b) }
+func BenchmarkEncrypt1MBWithDirectCBC128(b *testing.B)  { benchEncrypt("1MB", "DirectCBC128", b) }
+func BenchmarkEncrypt64MBWithDirectCBC128(b *testing.B) { benchEncrypt("64MB", "DirectCBC128", b) }
+
+func BenchmarkEncrypt1BWithDirectGCM256(b *testing.B)   { benchEncrypt("1B", "DirectGCM256", b) }
+func BenchmarkEncrypt64BWithDirectGCM256(b *testing.B)  { benchEncrypt("64B", "DirectGCM256", b) }
+func BenchmarkEncrypt1KBWithDirectGCM256(b *testing.B)  { benchEncrypt("1KB", "DirectGCM256", b) }
+func BenchmarkEncrypt64KBWithDirectGCM256(b *testing.B) { benchEncrypt("64KB", "DirectGCM256", b) }
+func BenchmarkEncrypt1MBWithDirectGCM256(b *testing.B)  { benchEncrypt("1MB", "DirectGCM256", b) }
+func BenchmarkEncrypt64MBWithDirectGCM256(b *testing.B) { benchEncrypt("64MB", "DirectGCM256", b) }
+
+func BenchmarkEncrypt1BWithDirectCBC256(b *testing.B)   { benchEncrypt("1B", "DirectCBC256", b) }
+func BenchmarkEncrypt64BWithDirectCBC256(b *testing.B)  { benchEncrypt("64B", "DirectCBC256", b) }
+func BenchmarkEncrypt1KBWithDirectCBC256(b *testing.B)  { benchEncrypt("1KB", "DirectCBC256", b) }
+func BenchmarkEncrypt64KBWithDirectCBC256(b *testing.B) { benchEncrypt("64KB", "DirectCBC256", b) }
+func BenchmarkEncrypt1MBWithDirectCBC256(b *testing.B)  { benchEncrypt("1MB", "DirectCBC256", b) }
+func BenchmarkEncrypt64MBWithDirectCBC256(b *testing.B) { benchEncrypt("64MB", "DirectCBC256", b) }
+
+func BenchmarkEncrypt1BWithAESKWAndGCM128(b *testing.B)   { benchEncrypt("1B", "AESKWAndGCM128", b) }
+func BenchmarkEncrypt64BWithAESKWAndGCM128(b *testing.B)  { benchEncrypt("64B", "AESKWAndGCM128", b) }
+func BenchmarkEncrypt1KBWithAESKWAndGCM128(b *testing.B)  { benchEncrypt("1KB", "AESKWAndGCM128", b) }
+func BenchmarkEncrypt64KBWithAESKWAndGCM128(b *testing.B) { benchEncrypt("64KB", "AESKWAndGCM128", b) }
+func BenchmarkEncrypt1MBWithAESKWAndGCM128(b *testing.B)  { benchEncrypt("1MB", "AESKWAndGCM128", b) }
+func BenchmarkEncrypt64MBWithAESKWAndGCM128(b *testing.B) { benchEncrypt("64MB", "AESKWAndGCM128", b) }
+
+func BenchmarkEncrypt1BWithAESKWAndCBC256(b *testing.B)   { benchEncrypt("1B", "AESKWAndCBC256", b) }
+func BenchmarkEncrypt64BWithAESKWAndCBC256(b *testing.B)  { benchEncrypt("64B", "AESKWAndCBC256", b) }
+func BenchmarkEncrypt1KBWithAESKWAndCBC256(b *testing.B)  { benchEncrypt("1KB", "AESKWAndCBC256", b) }
+func BenchmarkEncrypt64KBWithAESKWAndCBC256(b *testing.B) { benchEncrypt("64KB", "AESKWAndCBC256", b) }
+func BenchmarkEncrypt1MBWithAESKWAndCBC256(b *testing.B)  { benchEncrypt("1MB", "AESKWAndCBC256", b) }
+func BenchmarkEncrypt64MBWithAESKWAndCBC256(b *testing.B) { benchEncrypt("64MB", "AESKWAndCBC256", b) }
+
+func BenchmarkEncrypt1BWithECDHOnP256AndGCM128(b *testing.B) {
+	benchEncrypt("1B", "ECDHOnP256AndGCM128", b)
+}
+func BenchmarkEncrypt64BWithECDHOnP256AndGCM128(b *testing.B) {
+	benchEncrypt("64B", "ECDHOnP256AndGCM128", b)
+}
+func BenchmarkEncrypt1KBWithECDHOnP256AndGCM128(b *testing.B) {
+	benchEncrypt("1KB", "ECDHOnP256AndGCM128", b)
+}
+func BenchmarkEncrypt64KBWithECDHOnP256AndGCM128(b *testing.B) {
+	benchEncrypt("64KB", "ECDHOnP256AndGCM128", b)
+}
+func BenchmarkEncrypt1MBWithECDHOnP256AndGCM128(b *testing.B) {
+	benchEncrypt("1MB", "ECDHOnP256AndGCM128", b)
+}
+func BenchmarkEncrypt64MBWithECDHOnP256AndGCM128(b *testing.B) {
+	benchEncrypt("64MB", "ECDHOnP256AndGCM128", b)
+}
+
+func BenchmarkEncrypt1BWithECDHOnP384AndGCM128(b *testing.B) {
+	benchEncrypt("1B", "ECDHOnP384AndGCM128", b)
+}
+func BenchmarkEncrypt64BWithECDHOnP384AndGCM128(b *testing.B) {
+	benchEncrypt("64B", "ECDHOnP384AndGCM128", b)
+}
+func BenchmarkEncrypt1KBWithECDHOnP384AndGCM128(b *testing.B) {
+	benchEncrypt("1KB", "ECDHOnP384AndGCM128", b)
+}
+func BenchmarkEncrypt64KBWithECDHOnP384AndGCM128(b *testing.B) {
+	benchEncrypt("64KB", "ECDHOnP384AndGCM128", b)
+}
+func BenchmarkEncrypt1MBWithECDHOnP384AndGCM128(b *testing.B) {
+	benchEncrypt("1MB", "ECDHOnP384AndGCM128", b)
+}
+func BenchmarkEncrypt64MBWithECDHOnP384AndGCM128(b *testing.B) {
+	benchEncrypt("64MB", "ECDHOnP384AndGCM128", b)
+}
+
+func BenchmarkEncrypt1BWithECDHOnP521AndGCM128(b *testing.B) {
+	benchEncrypt("1B", "ECDHOnP521AndGCM128", b)
+}
+func BenchmarkEncrypt64BWithECDHOnP521AndGCM128(b *testing.B) {
+	benchEncrypt("64B", "ECDHOnP521AndGCM128", b)
+}
+func BenchmarkEncrypt1KBWithECDHOnP521AndGCM128(b *testing.B) {
+	benchEncrypt("1KB", "ECDHOnP521AndGCM128", b)
+}
+func BenchmarkEncrypt64KBWithECDHOnP521AndGCM128(b *testing.B) {
+	benchEncrypt("64KB", "ECDHOnP521AndGCM128", b)
+}
+func BenchmarkEncrypt1MBWithECDHOnP521AndGCM128(b *testing.B) {
+	benchEncrypt("1MB", "ECDHOnP521AndGCM128", b)
+}
+func BenchmarkEncrypt64MBWithECDHOnP521AndGCM128(b *testing.B) {
+	benchEncrypt("64MB", "ECDHOnP521AndGCM128", b)
+}
+
+func benchEncrypt(chunkKey, primKey string, b *testing.B) {
+	data, ok := chunks[chunkKey]
+	if !ok {
+		b.Fatalf("unknown chunk size %s", chunkKey)
+	}
+
+	enc, ok := encrypters[primKey]
+	if !ok {
+		b.Fatalf("unknown encrypter %s", primKey)
+	}
+
+	b.SetBytes(int64(len(data)))
+	for i := 0; i < b.N; i++ {
+		enc.Encrypt(data)
+	}
+}
+
+var (
+	decryptionKeys = map[string]interface{}{
+		"OAEPAndGCM": rsaTestKey,
+		"PKCSAndGCM": rsaTestKey,
+		"OAEPAndCBC": rsaTestKey,
+		"PKCSAndCBC": rsaTestKey,
+
+		"DirectGCM128": symKey16,
+		"DirectCBC128": symKey32,
+		"DirectGCM256": symKey32,
+		"DirectCBC256": symKey64,
+
+		"AESKWAndGCM128": symKey16,
+		"AESKWAndCBC256": symKey32,
+
+		"ECDHOnP256AndGCM128": ecTestKey256,
+		"ECDHOnP384AndGCM128": ecTestKey384,
+		"ECDHOnP521AndGCM128": ecTestKey521,
+	}
+)
+
+func BenchmarkDecrypt1BWithOAEPAndGCM(b *testing.B)   { benchDecrypt("1B", "OAEPAndGCM", b) }
+func BenchmarkDecrypt64BWithOAEPAndGCM(b *testing.B)  { benchDecrypt("64B", "OAEPAndGCM", b) }
+func BenchmarkDecrypt1KBWithOAEPAndGCM(b *testing.B)  { benchDecrypt("1KB", "OAEPAndGCM", b) }
+func BenchmarkDecrypt64KBWithOAEPAndGCM(b *testing.B) { benchDecrypt("64KB", "OAEPAndGCM", b) }
+func BenchmarkDecrypt1MBWithOAEPAndGCM(b *testing.B)  { benchDecrypt("1MB", "OAEPAndGCM", b) }
+func BenchmarkDecrypt64MBWithOAEPAndGCM(b *testing.B) { benchDecrypt("64MB", "OAEPAndGCM", b) }
+
+func BenchmarkDecrypt1BWithPKCSAndGCM(b *testing.B)   { benchDecrypt("1B", "PKCSAndGCM", b) }
+func BenchmarkDecrypt64BWithPKCSAndGCM(b *testing.B)  { benchDecrypt("64B", "PKCSAndGCM", b) }
+func BenchmarkDecrypt1KBWithPKCSAndGCM(b *testing.B)  { benchDecrypt("1KB", "PKCSAndGCM", b) }
+func BenchmarkDecrypt64KBWithPKCSAndGCM(b *testing.B) { benchDecrypt("64KB", "PKCSAndGCM", b) }
+func BenchmarkDecrypt1MBWithPKCSAndGCM(b *testing.B)  { benchDecrypt("1MB", "PKCSAndGCM", b) }
+func BenchmarkDecrypt64MBWithPKCSAndGCM(b *testing.B) { benchDecrypt("64MB", "PKCSAndGCM", b) }
+
+func BenchmarkDecrypt1BWithOAEPAndCBC(b *testing.B)   { benchDecrypt("1B", "OAEPAndCBC", b) }
+func BenchmarkDecrypt64BWithOAEPAndCBC(b *testing.B)  { benchDecrypt("64B", "OAEPAndCBC", b) }
+func BenchmarkDecrypt1KBWithOAEPAndCBC(b *testing.B)  { benchDecrypt("1KB", "OAEPAndCBC", b) }
+func BenchmarkDecrypt64KBWithOAEPAndCBC(b *testing.B) { benchDecrypt("64KB", "OAEPAndCBC", b) }
+func BenchmarkDecrypt1MBWithOAEPAndCBC(b *testing.B)  { benchDecrypt("1MB", "OAEPAndCBC", b) }
+func BenchmarkDecrypt64MBWithOAEPAndCBC(b *testing.B) { benchDecrypt("64MB", "OAEPAndCBC", b) }
+
+func BenchmarkDecrypt1BWithPKCSAndCBC(b *testing.B)   { benchDecrypt("1B", "PKCSAndCBC", b) }
+func BenchmarkDecrypt64BWithPKCSAndCBC(b *testing.B)  { benchDecrypt("64B", "PKCSAndCBC", b) }
+func BenchmarkDecrypt1KBWithPKCSAndCBC(b *testing.B)  { benchDecrypt("1KB", "PKCSAndCBC", b) }
+func BenchmarkDecrypt64KBWithPKCSAndCBC(b *testing.B) { benchDecrypt("64KB", "PKCSAndCBC", b) }
+func BenchmarkDecrypt1MBWithPKCSAndCBC(b *testing.B)  { benchDecrypt("1MB", "PKCSAndCBC", b) }
+func BenchmarkDecrypt64MBWithPKCSAndCBC(b *testing.B) { benchDecrypt("64MB", "PKCSAndCBC", b) }
+
+func BenchmarkDecrypt1BWithDirectGCM128(b *testing.B)   { benchDecrypt("1B", "DirectGCM128", b) }
+func BenchmarkDecrypt64BWithDirectGCM128(b *testing.B)  { benchDecrypt("64B", "DirectGCM128", b) }
+func BenchmarkDecrypt1KBWithDirectGCM128(b *testing.B)  { benchDecrypt("1KB", "DirectGCM128", b) }
+func BenchmarkDecrypt64KBWithDirectGCM128(b *testing.B) { benchDecrypt("64KB", "DirectGCM128", b) }
+func BenchmarkDecrypt1MBWithDirectGCM128(b *testing.B)  { benchDecrypt("1MB", "DirectGCM128", b) }
+func BenchmarkDecrypt64MBWithDirectGCM128(b *testing.B) { benchDecrypt("64MB", "DirectGCM128", b) }
+
+func BenchmarkDecrypt1BWithDirectCBC128(b *testing.B)   { benchDecrypt("1B", "DirectCBC128", b) }
+func BenchmarkDecrypt64BWithDirectCBC128(b *testing.B)  { benchDecrypt("64B", "DirectCBC128", b) }
+func BenchmarkDecrypt1KBWithDirectCBC128(b *testing.B)  { benchDecrypt("1KB", "DirectCBC128", b) }
+func BenchmarkDecrypt64KBWithDirectCBC128(b *testing.B) { benchDecrypt("64KB", "DirectCBC128", b) }
+func BenchmarkDecrypt1MBWithDirectCBC128(b *testing.B)  { benchDecrypt("1MB", "DirectCBC128", b) }
+func BenchmarkDecrypt64MBWithDirectCBC128(b *testing.B) { benchDecrypt("64MB", "DirectCBC128", b) }
+
+func BenchmarkDecrypt1BWithDirectGCM256(b *testing.B)   { benchDecrypt("1B", "DirectGCM256", b) }
+func BenchmarkDecrypt64BWithDirectGCM256(b *testing.B)  { benchDecrypt("64B", "DirectGCM256", b) }
+func BenchmarkDecrypt1KBWithDirectGCM256(b *testing.B)  { benchDecrypt("1KB", "DirectGCM256", b) }
+func BenchmarkDecrypt64KBWithDirectGCM256(b *testing.B) { benchDecrypt("64KB", "DirectGCM256", b) }
+func BenchmarkDecrypt1MBWithDirectGCM256(b *testing.B)  { benchDecrypt("1MB", "DirectGCM256", b) }
+func BenchmarkDecrypt64MBWithDirectGCM256(b *testing.B) { benchDecrypt("64MB", "DirectGCM256", b) }
+
+func BenchmarkDecrypt1BWithDirectCBC256(b *testing.B)   { benchDecrypt("1B", "DirectCBC256", b) }
+func BenchmarkDecrypt64BWithDirectCBC256(b *testing.B)  { benchDecrypt("64B", "DirectCBC256", b) }
+func BenchmarkDecrypt1KBWithDirectCBC256(b *testing.B)  { benchDecrypt("1KB", "DirectCBC256", b) }
+func BenchmarkDecrypt64KBWithDirectCBC256(b *testing.B) { benchDecrypt("64KB", "DirectCBC256", b) }
+func BenchmarkDecrypt1MBWithDirectCBC256(b *testing.B)  { benchDecrypt("1MB", "DirectCBC256", b) }
+func BenchmarkDecrypt64MBWithDirectCBC256(b *testing.B) { benchDecrypt("64MB", "DirectCBC256", b) }
+
+func BenchmarkDecrypt1BWithAESKWAndGCM128(b *testing.B)   { benchDecrypt("1B", "AESKWAndGCM128", b) }
+func BenchmarkDecrypt64BWithAESKWAndGCM128(b *testing.B)  { benchDecrypt("64B", "AESKWAndGCM128", b) }
+func BenchmarkDecrypt1KBWithAESKWAndGCM128(b *testing.B)  { benchDecrypt("1KB", "AESKWAndGCM128", b) }
+func BenchmarkDecrypt64KBWithAESKWAndGCM128(b *testing.B) { benchDecrypt("64KB", "AESKWAndGCM128", b) }
+func BenchmarkDecrypt1MBWithAESKWAndGCM128(b *testing.B)  { benchDecrypt("1MB", "AESKWAndGCM128", b) }
+func BenchmarkDecrypt64MBWithAESKWAndGCM128(b *testing.B) { benchDecrypt("64MB", "AESKWAndGCM128", b) }
+
+func BenchmarkDecrypt1BWithAESKWAndCBC256(b *testing.B)   { benchDecrypt("1B", "AESKWAndCBC256", b) }
+func BenchmarkDecrypt64BWithAESKWAndCBC256(b *testing.B)  { benchDecrypt("64B", "AESKWAndCBC256", b) }
+func BenchmarkDecrypt1KBWithAESKWAndCBC256(b *testing.B)  { benchDecrypt("1KB", "AESKWAndCBC256", b) }
+func BenchmarkDecrypt64KBWithAESKWAndCBC256(b *testing.B) { benchDecrypt("64KB", "AESKWAndCBC256", b) }
+func BenchmarkDecrypt1MBWithAESKWAndCBC256(b *testing.B)  { benchDecrypt("1MB", "AESKWAndCBC256", b) }
+func BenchmarkDecrypt64MBWithAESKWAndCBC256(b *testing.B) { benchDecrypt("64MB", "AESKWAndCBC256", b) }
+
+func BenchmarkDecrypt1BWithECDHOnP256AndGCM128(b *testing.B) {
+	benchDecrypt("1B", "ECDHOnP256AndGCM128", b)
+}
+func BenchmarkDecrypt64BWithECDHOnP256AndGCM128(b *testing.B) {
+	benchDecrypt("64B", "ECDHOnP256AndGCM128", b)
+}
+func BenchmarkDecrypt1KBWithECDHOnP256AndGCM128(b *testing.B) {
+	benchDecrypt("1KB", "ECDHOnP256AndGCM128", b)
+}
+func BenchmarkDecrypt64KBWithECDHOnP256AndGCM128(b *testing.B) {
+	benchDecrypt("64KB", "ECDHOnP256AndGCM128", b)
+}
+func BenchmarkDecrypt1MBWithECDHOnP256AndGCM128(b *testing.B) {
+	benchDecrypt("1MB", "ECDHOnP256AndGCM128", b)
+}
+func BenchmarkDecrypt64MBWithECDHOnP256AndGCM128(b *testing.B) {
+	benchDecrypt("64MB", "ECDHOnP256AndGCM128", b)
+}
+
+func BenchmarkDecrypt1BWithECDHOnP384AndGCM128(b *testing.B) {
+	benchDecrypt("1B", "ECDHOnP384AndGCM128", b)
+}
+func BenchmarkDecrypt64BWithECDHOnP384AndGCM128(b *testing.B) {
+	benchDecrypt("64B", "ECDHOnP384AndGCM128", b)
+}
+func BenchmarkDecrypt1KBWithECDHOnP384AndGCM128(b *testing.B) {
+	benchDecrypt("1KB", "ECDHOnP384AndGCM128", b)
+}
+func BenchmarkDecrypt64KBWithECDHOnP384AndGCM128(b *testing.B) {
+	benchDecrypt("64KB", "ECDHOnP384AndGCM128", b)
+}
+func BenchmarkDecrypt1MBWithECDHOnP384AndGCM128(b *testing.B) {
+	benchDecrypt("1MB", "ECDHOnP384AndGCM128", b)
+}
+func BenchmarkDecrypt64MBWithECDHOnP384AndGCM128(b *testing.B) {
+	benchDecrypt("64MB", "ECDHOnP384AndGCM128", b)
+}
+
+func BenchmarkDecrypt1BWithECDHOnP521AndGCM128(b *testing.B) {
+	benchDecrypt("1B", "ECDHOnP521AndGCM128", b)
+}
+func BenchmarkDecrypt64BWithECDHOnP521AndGCM128(b *testing.B) {
+	benchDecrypt("64B", "ECDHOnP521AndGCM128", b)
+}
+func BenchmarkDecrypt1KBWithECDHOnP521AndGCM128(b *testing.B) {
+	benchDecrypt("1KB", "ECDHOnP521AndGCM128", b)
+}
+func BenchmarkDecrypt64KBWithECDHOnP521AndGCM128(b *testing.B) {
+	benchDecrypt("64KB", "ECDHOnP521AndGCM128", b)
+}
+func BenchmarkDecrypt1MBWithECDHOnP521AndGCM128(b *testing.B) {
+	benchDecrypt("1MB", "ECDHOnP521AndGCM128", b)
+}
+func BenchmarkDecrypt64MBWithECDHOnP521AndGCM128(b *testing.B) {
+	benchDecrypt("64MB", "ECDHOnP521AndGCM128", b)
+}
+
+func benchDecrypt(chunkKey, primKey string, b *testing.B) {
+	chunk, ok := chunks[chunkKey]
+	if !ok {
+		b.Fatalf("unknown chunk size %s", chunkKey)
+	}
+
+	enc, ok := encrypters[primKey]
+	if !ok {
+		b.Fatalf("unknown encrypter %s", primKey)
+	}
+
+	dec, ok := decryptionKeys[primKey]
+	if !ok {
+		b.Fatalf("unknown decryption key %s", primKey)
+	}
+
+	data, err := enc.Encrypt(chunk)
+	if err != nil {
+		b.Fatal(err)
+	}
+
+	b.SetBytes(int64(len(chunk)))
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		data.Decrypt(dec)
+	}
+}
+
+func mustEncrypter(keyAlg KeyAlgorithm, encAlg ContentEncryption, encryptionKey interface{}) Encrypter {
+	enc, err := NewEncrypter(encAlg, Recipient{Algorithm: keyAlg, Key: encryptionKey}, nil)
+	if err != nil {
+		panic(err)
+	}
+	return enc
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/cryptosigner/cryptosigner.go b/vendor/gopkg.in/square/go-jose.v2/cryptosigner/cryptosigner.go
new file mode 100644
index 0000000..0ec9876
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/cryptosigner/cryptosigner.go
@@ -0,0 +1,138 @@
+/*-
+ * Copyright 2018 Square Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// Package cryptosigner implements an OpaqueSigner that wraps a "crypto".Signer
+//
+// https://godoc.org/crypto#Signer
+package cryptosigner
+
+import (
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/rand"
+	"crypto/rsa"
+	"encoding/asn1"
+	"io"
+	"math/big"
+
+	"golang.org/x/crypto/ed25519"
+	"gopkg.in/square/go-jose.v2"
+)
+
+// Opaque creates an OpaqueSigner from a "crypto".Signer
+func Opaque(s crypto.Signer) jose.OpaqueSigner {
+	pk := &jose.JSONWebKey{
+		Key: s.Public(),
+	}
+	return &cryptoSigner{signer: s, rand: rand.Reader, pk: pk}
+}
+
+type cryptoSigner struct {
+	pk     *jose.JSONWebKey
+	signer crypto.Signer
+	rand   io.Reader
+}
+
+func (s *cryptoSigner) Public() *jose.JSONWebKey {
+	return s.pk
+}
+
+func (s *cryptoSigner) Algs() []jose.SignatureAlgorithm {
+	switch s.signer.Public().(type) {
+	case ed25519.PublicKey:
+		return []jose.SignatureAlgorithm{jose.EdDSA}
+	case *ecdsa.PublicKey:
+		// This could be more precise
+		return []jose.SignatureAlgorithm{jose.ES256, jose.ES384, jose.ES512}
+	case *rsa.PublicKey:
+		return []jose.SignatureAlgorithm{jose.RS256, jose.RS384, jose.RS512, jose.PS256, jose.PS384, jose.PS512}
+	default:
+		return nil
+	}
+}
+
+func (s *cryptoSigner) SignPayload(payload []byte, alg jose.SignatureAlgorithm) ([]byte, error) {
+	var hash crypto.Hash
+	switch alg {
+	case jose.EdDSA:
+	case jose.RS256, jose.PS256, jose.ES256:
+		hash = crypto.SHA256
+	case jose.RS384, jose.PS384, jose.ES384:
+		hash = crypto.SHA384
+	case jose.RS512, jose.PS512, jose.ES512:
+		hash = crypto.SHA512
+	default:
+		return nil, jose.ErrUnsupportedAlgorithm
+	}
+
+	var hashed []byte
+	if hash != crypto.Hash(0) {
+		hasher := hash.New()
+		if _, err := hasher.Write(payload); err != nil {
+			return nil, err
+		}
+		hashed = hasher.Sum(nil)
+	}
+
+	var (
+		out []byte
+		err error
+	)
+	switch alg {
+	case jose.EdDSA:
+		out, err = s.signer.Sign(s.rand, payload, crypto.Hash(0))
+	case jose.ES256, jose.ES384, jose.ES512:
+		var byteLen int
+		switch alg {
+		case jose.ES256:
+			byteLen = 32
+		case jose.ES384:
+			byteLen = 48
+		case jose.ES512:
+			byteLen = 66
+		}
+		var b []byte
+		b, err = s.signer.Sign(s.rand, hashed, hash)
+		if err != nil {
+			return nil, err
+		}
+
+		sig := struct {
+			R, S *big.Int
+		}{}
+		if _, err = asn1.Unmarshal(b, &sig); err != nil {
+			return nil, err
+		}
+
+		rBytes := sig.R.Bytes()
+		rBytesPadded := make([]byte, byteLen)
+		copy(rBytesPadded[byteLen-len(rBytes):], rBytes)
+
+		sBytes := sig.S.Bytes()
+		sBytesPadded := make([]byte, byteLen)
+		copy(sBytesPadded[byteLen-len(sBytes):], sBytes)
+
+		out = append(rBytesPadded, sBytesPadded...)
+	case jose.RS256, jose.RS384, jose.RS512:
+		out, err = s.signer.Sign(s.rand, hashed, hash)
+	case jose.PS256, jose.PS384, jose.PS512:
+		out, err = s.signer.Sign(s.rand, hashed, &rsa.PSSOptions{
+			SaltLength: rsa.PSSSaltLengthAuto,
+			Hash:       hash,
+		})
+	}
+	return out, err
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/cryptosigner/cryptosigner_test.go b/vendor/gopkg.in/square/go-jose.v2/cryptosigner/cryptosigner_test.go
new file mode 100644
index 0000000..0b5ae08
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/cryptosigner/cryptosigner_test.go
@@ -0,0 +1,137 @@
+/*-
+ * Copyright 2018 Square Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package cryptosigner
+
+import (
+	"bytes"
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/rsa"
+	"fmt"
+	"testing"
+
+	"golang.org/x/crypto/ed25519"
+	"gopkg.in/square/go-jose.v2"
+)
+
+func TestRoundtripsJWSCryptoSigner(t *testing.T) {
+	sigAlgs := []jose.SignatureAlgorithm{jose.RS256, jose.RS384, jose.RS512, jose.PS256, jose.PS384, jose.PS512, jose.ES256, jose.ES384, jose.ES512, jose.EdDSA}
+
+	serializers := []func(*jose.JSONWebSignature) (string, error){
+		func(obj *jose.JSONWebSignature) (string, error) { return obj.CompactSerialize() },
+		func(obj *jose.JSONWebSignature) (string, error) { return obj.FullSerialize(), nil },
+	}
+
+	for _, alg := range sigAlgs {
+		signingKey, verificationKey := generateSigningTestKey(alg)
+
+		for i, serializer := range serializers {
+			err := roundtripJWS(alg, serializer, Opaque(signingKey.(crypto.Signer)), verificationKey)
+			if err != nil {
+				t.Error(err, alg, i)
+			}
+		}
+	}
+}
+
+type staticNonceSource string
+
+func (sns staticNonceSource) Nonce() (string, error) {
+	return string(sns), nil
+}
+
+func roundtripJWS(sigAlg jose.SignatureAlgorithm, serializer func(*jose.JSONWebSignature) (string, error), signingKey interface{}, verificationKey interface{}) error {
+	nonce := "test_nonce"
+	opts := &jose.SignerOptions{
+		NonceSource: staticNonceSource(nonce),
+	}
+
+	signer, err := jose.NewSigner(jose.SigningKey{Algorithm: sigAlg, Key: signingKey}, opts)
+	if err != nil {
+		return fmt.Errorf("error on new signer: %s", err)
+	}
+
+	input := []byte("Lorem ipsum dolor sit amet")
+	obj, err := signer.Sign(input)
+	if err != nil {
+		return fmt.Errorf("error on sign: %s", err)
+	}
+
+	msg, err := serializer(obj)
+	if err != nil {
+		return fmt.Errorf("error on serialize: %s", err)
+	}
+
+	obj, err = jose.ParseSigned(msg)
+	if err != nil {
+		return fmt.Errorf("error on parse: %s", err)
+	}
+
+	output, err := obj.Verify(verificationKey)
+	if err != nil {
+		return fmt.Errorf("error on verify: %s", err)
+	}
+
+	// Check that verify works with embedded keys (if present)
+	for i, sig := range obj.Signatures {
+		if sig.Header.JSONWebKey != nil {
+			_, err = obj.Verify(sig.Header.JSONWebKey)
+			if err != nil {
+				return fmt.Errorf("error on verify with embedded key %d: %s", i, err)
+			}
+		}
+
+		// Check that the nonce correctly round-tripped (if present)
+		if sig.Header.Nonce != nonce {
+			return fmt.Errorf("Incorrect nonce returned: [%s]", sig.Header.Nonce)
+		}
+	}
+
+	if bytes.Compare(output, input) != 0 {
+		return fmt.Errorf("input/output do not match, got '%s', expected '%s'", output, input)
+	}
+
+	return nil
+}
+
+func generateSigningTestKey(sigAlg jose.SignatureAlgorithm) (sig, ver interface{}) {
+	switch sigAlg {
+	case jose.EdDSA:
+		ver, sig, _ = ed25519.GenerateKey(rand.Reader)
+	case jose.RS256, jose.RS384, jose.RS512, jose.PS256, jose.PS384, jose.PS512:
+		rsaTestKey, _ := rsa.GenerateKey(rand.Reader, 2048)
+		sig = rsaTestKey
+		ver = &rsaTestKey.PublicKey
+	case jose.ES256:
+		key, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+		sig = key
+		ver = &key.PublicKey
+	case jose.ES384:
+		key, _ := ecdsa.GenerateKey(elliptic.P384(), rand.Reader)
+		sig = key
+		ver = &key.PublicKey
+	case jose.ES512:
+		key, _ := ecdsa.GenerateKey(elliptic.P521(), rand.Reader)
+		sig = key
+		ver = &key.PublicKey
+	default:
+		panic("Must update test case")
+	}
+	return
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/doc.go b/vendor/gopkg.in/square/go-jose.v2/doc.go
new file mode 100644
index 0000000..dd1387f
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/doc.go
@@ -0,0 +1,27 @@
+/*-
+ * Copyright 2014 Square Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
+
+Package jose aims to provide an implementation of the Javascript Object Signing
+and Encryption set of standards. It implements encryption and signing based on
+the JSON Web Encryption and JSON Web Signature standards, with optional JSON
+Web Token support available in a sub-package. The library supports both the
+compact and full serialization formats, and has optional support for multiple
+recipients.
+
+*/
+package jose
diff --git a/vendor/gopkg.in/square/go-jose.v2/doc_test.go b/vendor/gopkg.in/square/go-jose.v2/doc_test.go
new file mode 100644
index 0000000..1ee1478
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/doc_test.go
@@ -0,0 +1,201 @@
+/*-
+ * Copyright 2014 Square Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package jose
+
+import (
+	"crypto/ecdsa"
+	"crypto/rand"
+	"crypto/rsa"
+	"fmt"
+)
+
+// Dummy encrypter for use in examples
+var encrypter Encrypter
+
+func Example_jWE() {
+	// Generate a public/private key pair to use for this example.
+	privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		panic(err)
+	}
+
+	// Instantiate an encrypter using RSA-OAEP with AES128-GCM. An error would
+	// indicate that the selected algorithm(s) are not currently supported.
+	publicKey := &privateKey.PublicKey
+	encrypter, err := NewEncrypter(A128GCM, Recipient{Algorithm: RSA_OAEP, Key: publicKey}, nil)
+	if err != nil {
+		panic(err)
+	}
+
+	// Encrypt a sample plaintext. Calling the encrypter returns an encrypted
+	// JWE object, which can then be serialized for output afterwards. An error
+	// would indicate a problem in an underlying cryptographic primitive.
+	var plaintext = []byte("Lorem ipsum dolor sit amet")
+	object, err := encrypter.Encrypt(plaintext)
+	if err != nil {
+		panic(err)
+	}
+
+	// Serialize the encrypted object using the full serialization format.
+	// Alternatively you can also use the compact format here by calling
+	// object.CompactSerialize() instead.
+	serialized := object.FullSerialize()
+
+	// Parse the serialized, encrypted JWE object. An error would indicate that
+	// the given input did not represent a valid message.
+	object, err = ParseEncrypted(serialized)
+	if err != nil {
+		panic(err)
+	}
+
+	// Now we can decrypt and get back our original plaintext. An error here
+	// would indicate the the message failed to decrypt, e.g. because the auth
+	// tag was broken or the message was tampered with.
+	decrypted, err := object.Decrypt(privateKey)
+	if err != nil {
+		panic(err)
+	}
+
+	fmt.Printf(string(decrypted))
+	// output: Lorem ipsum dolor sit amet
+}
+
+func Example_jWS() {
+	// Generate a public/private key pair to use for this example.
+	privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		panic(err)
+	}
+
+	// Instantiate a signer using RSASSA-PSS (SHA512) with the given private key.
+	signer, err := NewSigner(SigningKey{Algorithm: PS512, Key: privateKey}, nil)
+	if err != nil {
+		panic(err)
+	}
+
+	// Sign a sample payload. Calling the signer returns a protected JWS object,
+	// which can then be serialized for output afterwards. An error would
+	// indicate a problem in an underlying cryptographic primitive.
+	var payload = []byte("Lorem ipsum dolor sit amet")
+	object, err := signer.Sign(payload)
+	if err != nil {
+		panic(err)
+	}
+
+	// Serialize the encrypted object using the full serialization format.
+	// Alternatively you can also use the compact format here by calling
+	// object.CompactSerialize() instead.
+	serialized := object.FullSerialize()
+
+	// Parse the serialized, protected JWS object. An error would indicate that
+	// the given input did not represent a valid message.
+	object, err = ParseSigned(serialized)
+	if err != nil {
+		panic(err)
+	}
+
+	// Now we can verify the signature on the payload. An error here would
+	// indicate the the message failed to verify, e.g. because the signature was
+	// broken or the message was tampered with.
+	output, err := object.Verify(&privateKey.PublicKey)
+	if err != nil {
+		panic(err)
+	}
+
+	fmt.Printf(string(output))
+	// output: Lorem ipsum dolor sit amet
+}
+
+func ExampleNewEncrypter_publicKey() {
+	var publicKey *rsa.PublicKey
+
+	// Instantiate an encrypter using RSA-OAEP with AES128-GCM.
+	NewEncrypter(A128GCM, Recipient{Algorithm: RSA_OAEP, Key: publicKey}, nil)
+
+	// Instantiate an encrypter using RSA-PKCS1v1.5 with AES128-CBC+HMAC.
+	NewEncrypter(A128CBC_HS256, Recipient{Algorithm: RSA1_5, Key: publicKey}, nil)
+}
+
+func ExampleNewEncrypter_symmetric() {
+	var sharedKey []byte
+
+	// Instantiate an encrypter using AES128-GCM with AES-GCM key wrap.
+	NewEncrypter(A128GCM, Recipient{Algorithm: A128GCMKW, Key: sharedKey}, nil)
+
+	// Instantiate an encrypter using AES128-GCM directly, w/o key wrapping.
+	NewEncrypter(A128GCM, Recipient{Algorithm: DIRECT, Key: sharedKey}, nil)
+}
+
+func ExampleNewSigner_publicKey() {
+	var rsaPrivateKey *rsa.PrivateKey
+	var ecdsaPrivateKey *ecdsa.PrivateKey
+
+	// Instantiate a signer using RSA-PKCS#1v1.5 with SHA-256.
+	NewSigner(SigningKey{Algorithm: RS256, Key: rsaPrivateKey}, nil)
+
+	// Instantiate a signer using ECDSA with SHA-384.
+	NewSigner(SigningKey{Algorithm: ES384, Key: ecdsaPrivateKey}, nil)
+}
+
+func ExampleNewSigner_symmetric() {
+	var sharedKey []byte
+
+	// Instantiate an signer using HMAC-SHA256.
+	NewSigner(SigningKey{Algorithm: HS256, Key: sharedKey}, nil)
+
+	// Instantiate an signer using HMAC-SHA512.
+	NewSigner(SigningKey{Algorithm: HS512, Key: sharedKey}, nil)
+}
+
+func ExampleNewMultiEncrypter() {
+	var publicKey *rsa.PublicKey
+	var sharedKey []byte
+
+	// Instantiate an encrypter using AES-GCM.
+	NewMultiEncrypter(A128GCM, []Recipient{
+		{Algorithm: A128GCMKW, Key: sharedKey},
+		{Algorithm: RSA_OAEP, Key: publicKey},
+	}, nil)
+}
+
+func ExampleNewMultiSigner() {
+	var privateKey *rsa.PrivateKey
+	var sharedKey []byte
+
+	// Instantiate a signer for multiple recipients.
+	NewMultiSigner([]SigningKey{
+		{Algorithm: HS256, Key: sharedKey},
+		{Algorithm: PS384, Key: privateKey},
+	}, nil)
+}
+
+func ExampleEncrypter_encrypt() {
+	// Encrypt a plaintext in order to get an encrypted JWE object.
+	var plaintext = []byte("This is a secret message")
+
+	encrypter.Encrypt(plaintext)
+}
+
+func ExampleEncrypter_encryptWithAuthData() {
+	// Encrypt a plaintext in order to get an encrypted JWE object. Also attach
+	// some additional authenticated data (AAD) to the object. Note that objects
+	// with attached AAD can only be represented using full serialization.
+	var plaintext = []byte("This is a secret message")
+	var aad = []byte("This is authenticated, but public data")
+
+	encrypter.EncryptWithAuthData(plaintext, aad)
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/encoding.go b/vendor/gopkg.in/square/go-jose.v2/encoding.go
new file mode 100644
index 0000000..b9687c6
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/encoding.go
@@ -0,0 +1,179 @@
+/*-
+ * Copyright 2014 Square Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package jose
+
+import (
+	"bytes"
+	"compress/flate"
+	"encoding/base64"
+	"encoding/binary"
+	"io"
+	"math/big"
+	"regexp"
+
+	"gopkg.in/square/go-jose.v2/json"
+)
+
+var stripWhitespaceRegex = regexp.MustCompile("\\s")
+
+// Helper function to serialize known-good objects.
+// Precondition: value is not a nil pointer.
+func mustSerializeJSON(value interface{}) []byte {
+	out, err := json.Marshal(value)
+	if err != nil {
+		panic(err)
+	}
+	// We never want to serialize the top-level value "null," since it's not a
+	// valid JOSE message. But if a caller passes in a nil pointer to this method,
+	// MarshalJSON will happily serialize it as the top-level value "null". If
+	// that value is then embedded in another operation, for instance by being
+	// base64-encoded and fed as input to a signing algorithm
+	// (https://github.com/square/go-jose/issues/22), the result will be
+	// incorrect. Because this method is intended for known-good objects, and a nil
+	// pointer is not a known-good object, we are free to panic in this case.
+	// Note: It's not possible to directly check whether the data pointed at by an
+	// interface is a nil pointer, so we do this hacky workaround.
+	// https://groups.google.com/forum/#!topic/golang-nuts/wnH302gBa4I
+	if string(out) == "null" {
+		panic("Tried to serialize a nil pointer.")
+	}
+	return out
+}
+
+// Strip all newlines and whitespace
+func stripWhitespace(data string) string {
+	return stripWhitespaceRegex.ReplaceAllString(data, "")
+}
+
+// Perform compression based on algorithm
+func compress(algorithm CompressionAlgorithm, input []byte) ([]byte, error) {
+	switch algorithm {
+	case DEFLATE:
+		return deflate(input)
+	default:
+		return nil, ErrUnsupportedAlgorithm
+	}
+}
+
+// Perform decompression based on algorithm
+func decompress(algorithm CompressionAlgorithm, input []byte) ([]byte, error) {
+	switch algorithm {
+	case DEFLATE:
+		return inflate(input)
+	default:
+		return nil, ErrUnsupportedAlgorithm
+	}
+}
+
+// Compress with DEFLATE
+func deflate(input []byte) ([]byte, error) {
+	output := new(bytes.Buffer)
+
+	// Writing to byte buffer, err is always nil
+	writer, _ := flate.NewWriter(output, 1)
+	_, _ = io.Copy(writer, bytes.NewBuffer(input))
+
+	err := writer.Close()
+	return output.Bytes(), err
+}
+
+// Decompress with DEFLATE
+func inflate(input []byte) ([]byte, error) {
+	output := new(bytes.Buffer)
+	reader := flate.NewReader(bytes.NewBuffer(input))
+
+	_, err := io.Copy(output, reader)
+	if err != nil {
+		return nil, err
+	}
+
+	err = reader.Close()
+	return output.Bytes(), err
+}
+
+// byteBuffer represents a slice of bytes that can be serialized to url-safe base64.
+type byteBuffer struct {
+	data []byte
+}
+
+func newBuffer(data []byte) *byteBuffer {
+	if data == nil {
+		return nil
+	}
+	return &byteBuffer{
+		data: data,
+	}
+}
+
+func newFixedSizeBuffer(data []byte, length int) *byteBuffer {
+	if len(data) > length {
+		panic("square/go-jose: invalid call to newFixedSizeBuffer (len(data) > length)")
+	}
+	pad := make([]byte, length-len(data))
+	return newBuffer(append(pad, data...))
+}
+
+func newBufferFromInt(num uint64) *byteBuffer {
+	data := make([]byte, 8)
+	binary.BigEndian.PutUint64(data, num)
+	return newBuffer(bytes.TrimLeft(data, "\x00"))
+}
+
+func (b *byteBuffer) MarshalJSON() ([]byte, error) {
+	return json.Marshal(b.base64())
+}
+
+func (b *byteBuffer) UnmarshalJSON(data []byte) error {
+	var encoded string
+	err := json.Unmarshal(data, &encoded)
+	if err != nil {
+		return err
+	}
+
+	if encoded == "" {
+		return nil
+	}
+
+	decoded, err := base64.RawURLEncoding.DecodeString(encoded)
+	if err != nil {
+		return err
+	}
+
+	*b = *newBuffer(decoded)
+
+	return nil
+}
+
+func (b *byteBuffer) base64() string {
+	return base64.RawURLEncoding.EncodeToString(b.data)
+}
+
+func (b *byteBuffer) bytes() []byte {
+	// Handling nil here allows us to transparently handle nil slices when serializing.
+	if b == nil {
+		return nil
+	}
+	return b.data
+}
+
+func (b byteBuffer) bigInt() *big.Int {
+	return new(big.Int).SetBytes(b.data)
+}
+
+func (b byteBuffer) toInt() int {
+	return int(b.bigInt().Int64())
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/encoding_test.go b/vendor/gopkg.in/square/go-jose.v2/encoding_test.go
new file mode 100644
index 0000000..c824e4c
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/encoding_test.go
@@ -0,0 +1,122 @@
+/*-
+ * Copyright 2014 Square Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package jose
+
+import (
+	"bytes"
+	"strings"
+	"testing"
+)
+
+func TestDeflateRoundtrip(t *testing.T) {
+	original := []byte("Lorem ipsum dolor sit amet")
+
+	compressed, err := deflate(original)
+	if err != nil {
+		panic(err)
+	}
+
+	output, err := inflate(compressed)
+	if err != nil {
+		panic(err)
+	}
+
+	if bytes.Compare(output, original) != 0 {
+		t.Error("Input and output do not match")
+	}
+}
+
+func TestInvalidCompression(t *testing.T) {
+	_, err := compress("XYZ", []byte{})
+	if err == nil {
+		t.Error("should not accept invalid algorithm")
+	}
+
+	_, err = decompress("XYZ", []byte{})
+	if err == nil {
+		t.Error("should not accept invalid algorithm")
+	}
+
+	_, err = decompress(DEFLATE, []byte{1, 2, 3, 4})
+	if err == nil {
+		t.Error("should not accept invalid data")
+	}
+}
+
+func TestByteBufferTrim(t *testing.T) {
+	buf := newBufferFromInt(1)
+	if !bytes.Equal(buf.data, []byte{1}) {
+		t.Error("Byte buffer for integer '1' should contain [0x01]")
+	}
+
+	buf = newBufferFromInt(65537)
+	if !bytes.Equal(buf.data, []byte{1, 0, 1}) {
+		t.Error("Byte buffer for integer '65537' should contain [0x01, 0x00, 0x01]")
+	}
+}
+
+func TestFixedSizeBuffer(t *testing.T) {
+	data0 := []byte{}
+	data1 := []byte{1}
+	data2 := []byte{1, 2}
+	data3 := []byte{1, 2, 3}
+	data4 := []byte{1, 2, 3, 4}
+
+	buf0 := newFixedSizeBuffer(data0, 4)
+	buf1 := newFixedSizeBuffer(data1, 4)
+	buf2 := newFixedSizeBuffer(data2, 4)
+	buf3 := newFixedSizeBuffer(data3, 4)
+	buf4 := newFixedSizeBuffer(data4, 4)
+
+	if !bytes.Equal(buf0.data, []byte{0, 0, 0, 0}) {
+		t.Error("Invalid padded buffer for buf0")
+	}
+	if !bytes.Equal(buf1.data, []byte{0, 0, 0, 1}) {
+		t.Error("Invalid padded buffer for buf1")
+	}
+	if !bytes.Equal(buf2.data, []byte{0, 0, 1, 2}) {
+		t.Error("Invalid padded buffer for buf2")
+	}
+	if !bytes.Equal(buf3.data, []byte{0, 1, 2, 3}) {
+		t.Error("Invalid padded buffer for buf3")
+	}
+	if !bytes.Equal(buf4.data, []byte{1, 2, 3, 4}) {
+		t.Error("Invalid padded buffer for buf4")
+	}
+}
+
+func TestSerializeJSONRejectsNil(t *testing.T) {
+	defer func() {
+		r := recover()
+		if r == nil || !strings.Contains(r.(string), "nil pointer") {
+			t.Error("serialize function should not accept nil pointer")
+		}
+	}()
+
+	mustSerializeJSON(nil)
+}
+
+func TestFixedSizeBufferTooLarge(t *testing.T) {
+	defer func() {
+		r := recover()
+		if r == nil {
+			t.Error("should not be able to create fixed size buffer with oversized data")
+		}
+	}()
+
+	newFixedSizeBuffer(make([]byte, 2), 1)
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/jose-util/README.md b/vendor/gopkg.in/square/go-jose.v2/jose-util/README.md
new file mode 100644
index 0000000..abb182c
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/jose-util/README.md
@@ -0,0 +1,59 @@
+# JOSE CLI
+
+The `jose-util` command line utility allows for encryption, decryption, signing
+and verification of JOSE messages. Its main purpose is to facilitate dealing
+with JOSE messages when testing or debugging.
+
+## Usage
+
+The utility includes the subcommands `encrypt`, `decrypt`, `sign`, `verify` and
+`expand`. Examples for each command can be found below.
+
+Algorithms are selected via the `--alg` and `--enc` flags, which influence the
+`alg` and `enc` headers in respectively. For JWE, `--alg` specifies the key
+management algorithm (e.g. `RSA-OAEP`) and `--enc` specifies the content
+encryption algorithm (e.g. `A128GCM`). For JWS, `--alg` specifies the
+signature algorithm (e.g. `PS256`).
+
+Input and output files can be specified via the `--in` and `--out` flags.
+Either flag can be omitted, in which case `jose-util` uses stdin/stdout for
+input/output respectively. By default each command will output a compact
+message, but it's possible to get the full serialization by supplying the
+`--full` flag.
+
+Keys are specified via the `--key` flag. Supported key types are naked RSA/EC
+keys and X.509 certificates with embedded RSA/EC keys. Keys must be in PEM
+or DER formats.
+
+## Examples
+
+### Encrypt
+
+Takes a plaintext as input, encrypts, and prints the encrypted message.
+
+    echo 'test message' | jose-util encrypt --key public-key.pem --alg RSA-OAEP --enc A128GCM
+
+### Decrypt
+
+Takes an encrypted message (JWE) as input, decrypts, and prints the plaintext.
+
+    jose-util decrypt --key private-key.pem
+
+### Sign
+
+Takes a payload as input, signs it, and prints the signed message with the embedded payload.
+
+    jose-util sign --key private-key.pem --alg PS256
+
+### Verify
+
+Reads a signed message (JWS), verifies it, and extracts the payload.
+
+    jose-util verify --key public-key.pem
+
+### Expand
+
+Expands a compact message to the full serialization format.
+
+    jose-util expand --format JWE   # Expands a compact JWE to full format
+    jose-util expand --format JWS   # Expands a compact JWS to full format
diff --git a/vendor/gopkg.in/square/go-jose.v2/jose-util/ec.key b/vendor/gopkg.in/square/go-jose.v2/jose-util/ec.key
new file mode 100644
index 0000000..3c6f199
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/jose-util/ec.key
@@ -0,0 +1,6 @@
+-----BEGIN EC PRIVATE KEY-----
+MIGkAgEBBDDvoj/bM1HokUjYWO/IDFs26Jo0GIFtU3tMQQu7ZabKscDMK3dZA0mK
+v97ij7BBFbCgBwYFK4EEACKhZANiAAT3KhQQCDFN32y/B72g+qOFw/5/aNx1MvZa
+rwDDa/2G3V0HLTS0VE82sLEUKS8xwkWFI+gNRXk0vvN+Hf+myJI1jOIY+tYQlh+C
+ZiKGNJ6g5/Su7V6ukGtN+UiY+sx+0LI=
+-----END EC PRIVATE KEY-----
diff --git a/vendor/gopkg.in/square/go-jose.v2/jose-util/ec.pub b/vendor/gopkg.in/square/go-jose.v2/jose-util/ec.pub
new file mode 100644
index 0000000..9f2cbe6
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/jose-util/ec.pub
@@ -0,0 +1,5 @@
+-----BEGIN PUBLIC KEY-----
+MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE9yoUEAgxTd9svwe9oPqjhcP+f2jcdTL2
+Wq8Aw2v9ht1dBy00tFRPNrCxFCkvMcJFhSPoDUV5NL7zfh3/psiSNYziGPrWEJYf
+gmYihjSeoOf0ru1erpBrTflImPrMftCy
+-----END PUBLIC KEY-----
diff --git a/vendor/gopkg.in/square/go-jose.v2/jose-util/jose-util.t b/vendor/gopkg.in/square/go-jose.v2/jose-util/jose-util.t
new file mode 100644
index 0000000..c0d747b
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/jose-util/jose-util.t
@@ -0,0 +1,94 @@
+Set up test keys.
+
+  $ cat > rsa.pub <<EOF
+  > -----BEGIN PUBLIC KEY-----
+  > MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAslWybuiNYR7uOgKuvaBw
+  > qVk8saEutKhOAaW+3hWF65gJei+ZV8QFfYDxs9ZaRZlWAUMtncQPnw7ZQlXO9ogN
+  > 5cMcN50C6qMOOZzghK7danalhF5lUETC4Hk3Eisbi/PR3IfVyXaRmqL6X66MKj/J
+  > AKyD9NFIDVy52K8A198Jojnrw2+XXQW72U68fZtvlyl/BTBWQ9Re5JSTpEcVmpCR
+  > 8FrFc0RPMBm+G5dRs08vvhZNiTT2JACO5V+J5ZrgP3s5hnGFcQFZgDnXLInDUdoi
+  > 1MuCjaAU0ta8/08pHMijNix5kFofdPEB954MiZ9k4kQ5/utt02I9x2ssHqw71ojj
+  > vwIDAQAB
+  > -----END PUBLIC KEY-----
+  > EOF
+
+  $ cat > rsa.key <<EOF
+  > -----BEGIN RSA PRIVATE KEY-----
+  > MIIEogIBAAKCAQEAslWybuiNYR7uOgKuvaBwqVk8saEutKhOAaW+3hWF65gJei+Z
+  > V8QFfYDxs9ZaRZlWAUMtncQPnw7ZQlXO9ogN5cMcN50C6qMOOZzghK7danalhF5l
+  > UETC4Hk3Eisbi/PR3IfVyXaRmqL6X66MKj/JAKyD9NFIDVy52K8A198Jojnrw2+X
+  > XQW72U68fZtvlyl/BTBWQ9Re5JSTpEcVmpCR8FrFc0RPMBm+G5dRs08vvhZNiTT2
+  > JACO5V+J5ZrgP3s5hnGFcQFZgDnXLInDUdoi1MuCjaAU0ta8/08pHMijNix5kFof
+  > dPEB954MiZ9k4kQ5/utt02I9x2ssHqw71ojjvwIDAQABAoIBABrYDYDmXom1BzUS
+  > PE1s/ihvt1QhqA8nmn5i/aUeZkc9XofW7GUqq4zlwPxKEtKRL0IHY7Fw1s0hhhCX
+  > LA0uE7F3OiMg7lR1cOm5NI6kZ83jyCxxrRx1DUSO2nxQotfhPsDMbaDiyS4WxEts
+  > 0cp2SYJhdYd/jTH9uDfmt+DGwQN7Jixio1Dj3vwB7krDY+mdre4SFY7Gbk9VxkDg
+  > LgCLMoq52m+wYufP8CTgpKFpMb2/yJrbLhuJxYZrJ3qd/oYo/91k6v7xlBKEOkwD
+  > 2veGk9Dqi8YPNxaRktTEjnZb6ybhezat93+VVxq4Oem3wMwou1SfXrSUKtgM/p2H
+  > vfw/76ECgYEA2fNL9tC8u9M0wjA+kvvtDG96qO6O66Hksssy6RWInD+Iqk3MtHQt
+  > LeoCjvX+zERqwOb6SI6empk5pZ9E3/9vJ0dBqkxx3nqn4M/nRWnExGgngJsL959t
+  > f50cdxva8y1RjNhT4kCwTrupX/TP8lAG8SfG1Alo2VFR8iWd8hDQcTECgYEA0Xfj
+  > EgqAsVh4U0s3lFxKjOepEyp0G1Imty5J16SvcOEAD1Mrmz94aSSp0bYhXNVdbf7n
+  > Rk77htWC7SE29fGjOzZRS76wxj/SJHF+rktHB2Zt23k1jBeZ4uLMPMnGLY/BJ099
+  > 5DTGo0yU0rrPbyXosx+ukfQLAHFuggX4RNeM5+8CgYB7M1J/hGMLcUpjcs4MXCgV
+  > XXbiw2c6v1r9zmtK4odEe42PZ0cNwpY/XAZyNZAAe7Q0stxL44K4NWEmxC80x7lX
+  > ZKozz96WOpNnO16qGC3IMHAT/JD5Or+04WTT14Ue7UEp8qcIQDTpbJ9DxKk/eglS
+  > jH+SIHeKULOXw7fSu7p4IQKBgBnyVchIUMSnBtCagpn4DKwDjif3nEY+GNmb/D2g
+  > ArNiy5UaYk5qwEmV5ws5GkzbiSU07AUDh5ieHgetk5dHhUayZcOSLWeBRFCLVnvU
+  > i0nZYEZNb1qZGdDG8zGcdNXz9qMd76Qy/WAA/nZT+Zn1AiweAovFxQ8a/etRPf2Z
+  > DbU1AoGAHpCgP7B/4GTBe49H0AQueQHBn4RIkgqMy9xiMeR+U+U0vaY0TlfLhnX+
+  > 5PkNfkPXohXlfL7pxwZNYa6FZhCAubzvhKCdUASivkoGaIEk6g1VTVYS/eDVQ4CA
+  > slfl+elXtLq/l1kQ8C14jlHrQzSXx4PQvjDEnAmaHSJNz4mP9Fg=
+  > -----END RSA PRIVATE KEY-----
+  > EOF
+
+  $ cat > ec.pub <<EOF
+  > -----BEGIN PUBLIC KEY-----
+  > MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE9yoUEAgxTd9svwe9oPqjhcP+f2jcdTL2
+  > Wq8Aw2v9ht1dBy00tFRPNrCxFCkvMcJFhSPoDUV5NL7zfh3/psiSNYziGPrWEJYf
+  > gmYihjSeoOf0ru1erpBrTflImPrMftCy
+  > -----END PUBLIC KEY-----
+  > EOF
+
+  $ cat > ec.key <<EOF
+  > -----BEGIN EC PRIVATE KEY-----
+  > MIGkAgEBBDDvoj/bM1HokUjYWO/IDFs26Jo0GIFtU3tMQQu7ZabKscDMK3dZA0mK
+  > v97ij7BBFbCgBwYFK4EEACKhZANiAAT3KhQQCDFN32y/B72g+qOFw/5/aNx1MvZa
+  > rwDDa/2G3V0HLTS0VE82sLEUKS8xwkWFI+gNRXk0vvN+Hf+myJI1jOIY+tYQlh+C
+  > ZiKGNJ6g5/Su7V6ukGtN+UiY+sx+0LI=
+  > -----END EC PRIVATE KEY-----
+  > EOF
+
+Encrypt and then decrypt a test message (RSA).
+
+  $ echo "Lorem ipsum dolor sit amet" | 
+  > jose-util encrypt --alg RSA-OAEP --enc A128GCM --key rsa.pub |
+  > jose-util decrypt --key rsa.key
+  Lorem ipsum dolor sit amet
+
+Encrypt and then decrypt a test message (EC).
+
+  $ echo "Lorem ipsum dolor sit amet" | 
+  > jose-util encrypt --alg ECDH-ES+A128KW --enc A128GCM --key ec.pub |
+  > jose-util decrypt --key ec.key
+  Lorem ipsum dolor sit amet
+
+Sign and verify a test message (RSA).
+
+  $ echo "Lorem ipsum dolor sit amet" | 
+  > jose-util sign --alg PS256 --key rsa.key |
+  > jose-util verify --key rsa.pub
+  Lorem ipsum dolor sit amet
+
+Sign and verify a test message (EC).
+
+  $ echo "Lorem ipsum dolor sit amet" | 
+  > jose-util sign --alg ES384 --key ec.key |
+  > jose-util verify --key ec.pub
+  Lorem ipsum dolor sit amet
+
+Expand a compact message to full format.
+
+  $ echo "eyJhbGciOiJFUzM4NCJ9.TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQK.QPU35XY913Im7ZEaN2yHykfbtPqjHZvYp-lV8OcTAJZs67bJFSdTSkQhQWE9ch6tvYrj_7py6HKaWVFLll_s_Rm6bmwq3JszsHrIvFFm1NydruYHhvAnx7rjYiqwOu0W" |
+  > jose-util expand --format JWS
+  {"payload":"TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQK","protected":"eyJhbGciOiJFUzM4NCJ9","signature":"QPU35XY913Im7ZEaN2yHykfbtPqjHZvYp-lV8OcTAJZs67bJFSdTSkQhQWE9ch6tvYrj_7py6HKaWVFLll_s_Rm6bmwq3JszsHrIvFFm1NydruYHhvAnx7rjYiqwOu0W"}
diff --git a/vendor/gopkg.in/square/go-jose.v2/jose-util/main.go b/vendor/gopkg.in/square/go-jose.v2/jose-util/main.go
new file mode 100644
index 0000000..272d9f0
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/jose-util/main.go
@@ -0,0 +1,189 @@
+/*-
+ * Copyright 2014 Square Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package main
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+
+	"gopkg.in/alecthomas/kingpin.v2"
+	"gopkg.in/square/go-jose.v2"
+)
+
+var (
+	app = kingpin.New("jose-util", "A command-line utility for dealing with JOSE objects.")
+
+	keyFile = app.Flag("key", "Path to key file (PEM or DER-encoded)").ExistingFile()
+	inFile  = app.Flag("in", "Path to input file (stdin if missing)").ExistingFile()
+	outFile = app.Flag("out", "Path to output file (stdout if missing)").ExistingFile()
+
+	encryptCommand = app.Command("encrypt", "Encrypt a plaintext, output ciphertext.")
+	algFlag        = encryptCommand.Flag("alg", "Key management algorithm (e.g. RSA-OAEP)").Required().String()
+	encFlag        = encryptCommand.Flag("enc", "Content encryption algorithm (e.g. A128GCM)").Required().String()
+
+	decryptCommand = app.Command("decrypt", "Decrypt a ciphertext, output plaintext.")
+
+	signCommand = app.Command("sign", "Sign a payload, output signed message.")
+	sigAlgFlag  = signCommand.Flag("alg", "Key management algorithm (e.g. RSA-OAEP)").Required().String()
+
+	verifyCommand = app.Command("verify", "Verify a signed message, output payload.")
+
+	expandCommand = app.Command("expand", "Expand JOSE object to full serialization format.")
+	formatFlag    = expandCommand.Flag("format", "Type of message to expand (JWS or JWE, defaults to JWE)").String()
+
+	full = app.Flag("full", "Use full serialization format (instead of compact)").Bool()
+)
+
+func main() {
+	app.Version("v2")
+
+	command := kingpin.MustParse(app.Parse(os.Args[1:]))
+
+	var keyBytes []byte
+	var err error
+	if command != "expand" {
+		keyBytes, err = ioutil.ReadFile(*keyFile)
+		exitOnError(err, "unable to read key file")
+	}
+
+	switch command {
+	case "encrypt":
+		pub, err := LoadPublicKey(keyBytes)
+		exitOnError(err, "unable to read public key")
+
+		alg := jose.KeyAlgorithm(*algFlag)
+		enc := jose.ContentEncryption(*encFlag)
+
+		crypter, err := jose.NewEncrypter(enc, jose.Recipient{Algorithm: alg, Key: pub}, nil)
+		exitOnError(err, "unable to instantiate encrypter")
+
+		obj, err := crypter.Encrypt(readInput(*inFile))
+		exitOnError(err, "unable to encrypt")
+
+		var msg string
+		if *full {
+			msg = obj.FullSerialize()
+		} else {
+			msg, err = obj.CompactSerialize()
+			exitOnError(err, "unable to serialize message")
+		}
+
+		writeOutput(*outFile, []byte(msg))
+	case "decrypt":
+		priv, err := LoadPrivateKey(keyBytes)
+		exitOnError(err, "unable to read private key")
+
+		obj, err := jose.ParseEncrypted(string(readInput(*inFile)))
+		exitOnError(err, "unable to parse message")
+
+		plaintext, err := obj.Decrypt(priv)
+		exitOnError(err, "unable to decrypt message")
+
+		writeOutput(*outFile, plaintext)
+	case "sign":
+		signingKey, err := LoadPrivateKey(keyBytes)
+		exitOnError(err, "unable to read private key")
+
+		alg := jose.SignatureAlgorithm(*sigAlgFlag)
+		signer, err := jose.NewSigner(jose.SigningKey{Algorithm: alg, Key: signingKey}, nil)
+		exitOnError(err, "unable to make signer")
+
+		obj, err := signer.Sign(readInput(*inFile))
+		exitOnError(err, "unable to sign")
+
+		var msg string
+		if *full {
+			msg = obj.FullSerialize()
+		} else {
+			msg, err = obj.CompactSerialize()
+			exitOnError(err, "unable to serialize message")
+		}
+
+		writeOutput(*outFile, []byte(msg))
+	case "verify":
+		verificationKey, err := LoadPublicKey(keyBytes)
+		exitOnError(err, "unable to read public key")
+
+		obj, err := jose.ParseSigned(string(readInput(*inFile)))
+		exitOnError(err, "unable to parse message")
+
+		plaintext, err := obj.Verify(verificationKey)
+		exitOnError(err, "invalid signature")
+
+		writeOutput(*outFile, plaintext)
+	case "expand":
+		input := string(readInput(*inFile))
+
+		var serialized string
+		var err error
+		switch *formatFlag {
+		case "", "JWE":
+			var jwe *jose.JSONWebEncryption
+			jwe, err = jose.ParseEncrypted(input)
+			if err == nil {
+				serialized = jwe.FullSerialize()
+			}
+		case "JWS":
+			var jws *jose.JSONWebSignature
+			jws, err = jose.ParseSigned(input)
+			if err == nil {
+				serialized = jws.FullSerialize()
+			}
+		}
+
+		exitOnError(err, "unable to expand message")
+		writeOutput(*outFile, []byte(serialized))
+		writeOutput(*outFile, []byte("\n"))
+	}
+}
+
+// Exit and print error message if we encountered a problem
+func exitOnError(err error, msg string) {
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "%s: %s\n", msg, err)
+		os.Exit(1)
+	}
+}
+
+// Read input from file or stdin
+func readInput(path string) []byte {
+	var bytes []byte
+	var err error
+
+	if path != "" {
+		bytes, err = ioutil.ReadFile(path)
+	} else {
+		bytes, err = ioutil.ReadAll(os.Stdin)
+	}
+
+	exitOnError(err, "unable to read input")
+	return bytes
+}
+
+// Write output to file or stdin
+func writeOutput(path string, data []byte) {
+	var err error
+
+	if path != "" {
+		err = ioutil.WriteFile(path, data, 0644)
+	} else {
+		_, err = os.Stdout.Write(data)
+	}
+
+	exitOnError(err, "unable to write output")
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/jose-util/test-keys/ecdh.key b/vendor/gopkg.in/square/go-jose.v2/jose-util/test-keys/ecdh.key
new file mode 100644
index 0000000..3c6f199
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/jose-util/test-keys/ecdh.key
@@ -0,0 +1,6 @@
+-----BEGIN EC PRIVATE KEY-----
+MIGkAgEBBDDvoj/bM1HokUjYWO/IDFs26Jo0GIFtU3tMQQu7ZabKscDMK3dZA0mK
+v97ij7BBFbCgBwYFK4EEACKhZANiAAT3KhQQCDFN32y/B72g+qOFw/5/aNx1MvZa
+rwDDa/2G3V0HLTS0VE82sLEUKS8xwkWFI+gNRXk0vvN+Hf+myJI1jOIY+tYQlh+C
+ZiKGNJ6g5/Su7V6ukGtN+UiY+sx+0LI=
+-----END EC PRIVATE KEY-----
diff --git a/vendor/gopkg.in/square/go-jose.v2/jose-util/test-keys/ecdh.pub b/vendor/gopkg.in/square/go-jose.v2/jose-util/test-keys/ecdh.pub
new file mode 100644
index 0000000..9f2cbe6
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/jose-util/test-keys/ecdh.pub
@@ -0,0 +1,5 @@
+-----BEGIN PUBLIC KEY-----
+MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE9yoUEAgxTd9svwe9oPqjhcP+f2jcdTL2
+Wq8Aw2v9ht1dBy00tFRPNrCxFCkvMcJFhSPoDUV5NL7zfh3/psiSNYziGPrWEJYf
+gmYihjSeoOf0ru1erpBrTflImPrMftCy
+-----END PUBLIC KEY-----
diff --git a/vendor/gopkg.in/square/go-jose.v2/jose-util/test-keys/rsa.key b/vendor/gopkg.in/square/go-jose.v2/jose-util/test-keys/rsa.key
new file mode 100644
index 0000000..c04aaad
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/jose-util/test-keys/rsa.key
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEogIBAAKCAQEAslWybuiNYR7uOgKuvaBwqVk8saEutKhOAaW+3hWF65gJei+Z
+V8QFfYDxs9ZaRZlWAUMtncQPnw7ZQlXO9ogN5cMcN50C6qMOOZzghK7danalhF5l
+UETC4Hk3Eisbi/PR3IfVyXaRmqL6X66MKj/JAKyD9NFIDVy52K8A198Jojnrw2+X
+XQW72U68fZtvlyl/BTBWQ9Re5JSTpEcVmpCR8FrFc0RPMBm+G5dRs08vvhZNiTT2
+JACO5V+J5ZrgP3s5hnGFcQFZgDnXLInDUdoi1MuCjaAU0ta8/08pHMijNix5kFof
+dPEB954MiZ9k4kQ5/utt02I9x2ssHqw71ojjvwIDAQABAoIBABrYDYDmXom1BzUS
+PE1s/ihvt1QhqA8nmn5i/aUeZkc9XofW7GUqq4zlwPxKEtKRL0IHY7Fw1s0hhhCX
+LA0uE7F3OiMg7lR1cOm5NI6kZ83jyCxxrRx1DUSO2nxQotfhPsDMbaDiyS4WxEts
+0cp2SYJhdYd/jTH9uDfmt+DGwQN7Jixio1Dj3vwB7krDY+mdre4SFY7Gbk9VxkDg
+LgCLMoq52m+wYufP8CTgpKFpMb2/yJrbLhuJxYZrJ3qd/oYo/91k6v7xlBKEOkwD
+2veGk9Dqi8YPNxaRktTEjnZb6ybhezat93+VVxq4Oem3wMwou1SfXrSUKtgM/p2H
+vfw/76ECgYEA2fNL9tC8u9M0wjA+kvvtDG96qO6O66Hksssy6RWInD+Iqk3MtHQt
+LeoCjvX+zERqwOb6SI6empk5pZ9E3/9vJ0dBqkxx3nqn4M/nRWnExGgngJsL959t
+f50cdxva8y1RjNhT4kCwTrupX/TP8lAG8SfG1Alo2VFR8iWd8hDQcTECgYEA0Xfj
+EgqAsVh4U0s3lFxKjOepEyp0G1Imty5J16SvcOEAD1Mrmz94aSSp0bYhXNVdbf7n
+Rk77htWC7SE29fGjOzZRS76wxj/SJHF+rktHB2Zt23k1jBeZ4uLMPMnGLY/BJ099
+5DTGo0yU0rrPbyXosx+ukfQLAHFuggX4RNeM5+8CgYB7M1J/hGMLcUpjcs4MXCgV
+XXbiw2c6v1r9zmtK4odEe42PZ0cNwpY/XAZyNZAAe7Q0stxL44K4NWEmxC80x7lX
+ZKozz96WOpNnO16qGC3IMHAT/JD5Or+04WTT14Ue7UEp8qcIQDTpbJ9DxKk/eglS
+jH+SIHeKULOXw7fSu7p4IQKBgBnyVchIUMSnBtCagpn4DKwDjif3nEY+GNmb/D2g
+ArNiy5UaYk5qwEmV5ws5GkzbiSU07AUDh5ieHgetk5dHhUayZcOSLWeBRFCLVnvU
+i0nZYEZNb1qZGdDG8zGcdNXz9qMd76Qy/WAA/nZT+Zn1AiweAovFxQ8a/etRPf2Z
+DbU1AoGAHpCgP7B/4GTBe49H0AQueQHBn4RIkgqMy9xiMeR+U+U0vaY0TlfLhnX+
+5PkNfkPXohXlfL7pxwZNYa6FZhCAubzvhKCdUASivkoGaIEk6g1VTVYS/eDVQ4CA
+slfl+elXtLq/l1kQ8C14jlHrQzSXx4PQvjDEnAmaHSJNz4mP9Fg=
+-----END RSA PRIVATE KEY-----
diff --git a/vendor/gopkg.in/square/go-jose.v2/jose-util/test-keys/rsa.pub b/vendor/gopkg.in/square/go-jose.v2/jose-util/test-keys/rsa.pub
new file mode 100644
index 0000000..f8ff0f4
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/jose-util/test-keys/rsa.pub
@@ -0,0 +1,9 @@
+-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAslWybuiNYR7uOgKuvaBw
+qVk8saEutKhOAaW+3hWF65gJei+ZV8QFfYDxs9ZaRZlWAUMtncQPnw7ZQlXO9ogN
+5cMcN50C6qMOOZzghK7danalhF5lUETC4Hk3Eisbi/PR3IfVyXaRmqL6X66MKj/J
+AKyD9NFIDVy52K8A198Jojnrw2+XXQW72U68fZtvlyl/BTBWQ9Re5JSTpEcVmpCR
+8FrFc0RPMBm+G5dRs08vvhZNiTT2JACO5V+J5ZrgP3s5hnGFcQFZgDnXLInDUdoi
+1MuCjaAU0ta8/08pHMijNix5kFofdPEB954MiZ9k4kQ5/utt02I9x2ssHqw71ojj
+vwIDAQAB
+-----END PUBLIC KEY-----
diff --git a/vendor/gopkg.in/square/go-jose.v2/jose-util/utils.go b/vendor/gopkg.in/square/go-jose.v2/jose-util/utils.go
new file mode 100644
index 0000000..4dccf10
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/jose-util/utils.go
@@ -0,0 +1,101 @@
+/*-
+ * Copyright 2014 Square Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package main
+
+import (
+	"crypto/x509"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"gopkg.in/square/go-jose.v2"
+)
+
+func LoadJSONWebKey(json []byte, pub bool) (*jose.JSONWebKey, error) {
+	var jwk jose.JSONWebKey
+	err := jwk.UnmarshalJSON(json)
+	if err != nil {
+		return nil, err
+	}
+	if !jwk.Valid() {
+		return nil, errors.New("invalid JWK key")
+	}
+	if jwk.IsPublic() != pub {
+		return nil, errors.New("priv/pub JWK key mismatch")
+	}
+	return &jwk, nil
+}
+
+// LoadPublicKey loads a public key from PEM/DER/JWK-encoded data.
+func LoadPublicKey(data []byte) (interface{}, error) {
+	input := data
+
+	block, _ := pem.Decode(data)
+	if block != nil {
+		input = block.Bytes
+	}
+
+	// Try to load SubjectPublicKeyInfo
+	pub, err0 := x509.ParsePKIXPublicKey(input)
+	if err0 == nil {
+		return pub, nil
+	}
+
+	cert, err1 := x509.ParseCertificate(input)
+	if err1 == nil {
+		return cert.PublicKey, nil
+	}
+
+	jwk, err2 := LoadJSONWebKey(data, true)
+	if err2 == nil {
+		return jwk, nil
+	}
+
+	return nil, fmt.Errorf("square/go-jose: parse error, got '%s', '%s' and '%s'", err0, err1, err2)
+}
+
+// LoadPrivateKey loads a private key from PEM/DER/JWK-encoded data.
+func LoadPrivateKey(data []byte) (interface{}, error) {
+	input := data
+
+	block, _ := pem.Decode(data)
+	if block != nil {
+		input = block.Bytes
+	}
+
+	var priv interface{}
+	priv, err0 := x509.ParsePKCS1PrivateKey(input)
+	if err0 == nil {
+		return priv, nil
+	}
+
+	priv, err1 := x509.ParsePKCS8PrivateKey(input)
+	if err1 == nil {
+		return priv, nil
+	}
+
+	priv, err2 := x509.ParseECPrivateKey(input)
+	if err2 == nil {
+		return priv, nil
+	}
+
+	jwk, err3 := LoadJSONWebKey(input, false)
+	if err3 == nil {
+		return jwk, nil
+	}
+
+	return nil, fmt.Errorf("square/go-jose: parse error, got '%s', '%s', '%s' and '%s'", err0, err1, err2, err3)
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/json/LICENSE b/vendor/gopkg.in/square/go-jose.v2/json/LICENSE
new file mode 100644
index 0000000..7448756
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/json/LICENSE
@@ -0,0 +1,27 @@
+Copyright (c) 2012 The Go Authors. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+   * Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+   * Redistributions in binary form must reproduce the above
+copyright notice, this list of conditions and the following disclaimer
+in the documentation and/or other materials provided with the
+distribution.
+   * Neither the name of Google Inc. nor the names of its
+contributors may be used to endorse or promote products derived from
+this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/vendor/gopkg.in/square/go-jose.v2/json/README.md b/vendor/gopkg.in/square/go-jose.v2/json/README.md
new file mode 100644
index 0000000..86de5e5
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/json/README.md
@@ -0,0 +1,13 @@
+# Safe JSON
+
+This repository contains a fork of the `encoding/json` package from Go 1.6.
+
+The following changes were made:
+
+* Object deserialization uses case-sensitive member name matching instead of
+  [case-insensitive matching](https://www.ietf.org/mail-archive/web/json/current/msg03763.html).
+  This is to avoid differences in the interpretation of JOSE messages between
+  go-jose and libraries written in other languages.
+* When deserializing a JSON object, we check for duplicate keys and reject the
+  input whenever we detect a duplicate. Rather than trying to work with malformed
+  data, we prefer to reject it right away.
diff --git a/vendor/gopkg.in/square/go-jose.v2/json/bench_test.go b/vendor/gopkg.in/square/go-jose.v2/json/bench_test.go
new file mode 100644
index 0000000..ed89d11
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/json/bench_test.go
@@ -0,0 +1,223 @@
+// Copyright 2011 The Go Authors.  All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Large data benchmark.
+// The JSON data is a summary of agl's changes in the
+// go, webkit, and chromium open source projects.
+// We benchmark converting between the JSON form
+// and in-memory data structures.
+
+package json
+
+import (
+	"bytes"
+	"compress/gzip"
+	"io/ioutil"
+	"os"
+	"strings"
+	"testing"
+)
+
+type codeResponse struct {
+	Tree     *codeNode `json:"tree"`
+	Username string    `json:"username"`
+}
+
+type codeNode struct {
+	Name     string      `json:"name"`
+	Kids     []*codeNode `json:"kids"`
+	CLWeight float64     `json:"cl_weight"`
+	Touches  int         `json:"touches"`
+	MinT     int64       `json:"min_t"`
+	MaxT     int64       `json:"max_t"`
+	MeanT    int64       `json:"mean_t"`
+}
+
+var codeJSON []byte
+var codeStruct codeResponse
+
+func codeInit() {
+	f, err := os.Open("testdata/code.json.gz")
+	if err != nil {
+		panic(err)
+	}
+	defer f.Close()
+	gz, err := gzip.NewReader(f)
+	if err != nil {
+		panic(err)
+	}
+	data, err := ioutil.ReadAll(gz)
+	if err != nil {
+		panic(err)
+	}
+
+	codeJSON = data
+
+	if err := Unmarshal(codeJSON, &codeStruct); err != nil {
+		panic("unmarshal code.json: " + err.Error())
+	}
+
+	if data, err = Marshal(&codeStruct); err != nil {
+		panic("marshal code.json: " + err.Error())
+	}
+
+	if !bytes.Equal(data, codeJSON) {
+		println("different lengths", len(data), len(codeJSON))
+		for i := 0; i < len(data) && i < len(codeJSON); i++ {
+			if data[i] != codeJSON[i] {
+				println("re-marshal: changed at byte", i)
+				println("orig: ", string(codeJSON[i-10:i+10]))
+				println("new: ", string(data[i-10:i+10]))
+				break
+			}
+		}
+		panic("re-marshal code.json: different result")
+	}
+}
+
+func BenchmarkCodeEncoder(b *testing.B) {
+	if codeJSON == nil {
+		b.StopTimer()
+		codeInit()
+		b.StartTimer()
+	}
+	enc := NewEncoder(ioutil.Discard)
+	for i := 0; i < b.N; i++ {
+		if err := enc.Encode(&codeStruct); err != nil {
+			b.Fatal("Encode:", err)
+		}
+	}
+	b.SetBytes(int64(len(codeJSON)))
+}
+
+func BenchmarkCodeMarshal(b *testing.B) {
+	if codeJSON == nil {
+		b.StopTimer()
+		codeInit()
+		b.StartTimer()
+	}
+	for i := 0; i < b.N; i++ {
+		if _, err := Marshal(&codeStruct); err != nil {
+			b.Fatal("Marshal:", err)
+		}
+	}
+	b.SetBytes(int64(len(codeJSON)))
+}
+
+func BenchmarkCodeDecoder(b *testing.B) {
+	if codeJSON == nil {
+		b.StopTimer()
+		codeInit()
+		b.StartTimer()
+	}
+	var buf bytes.Buffer
+	dec := NewDecoder(&buf)
+	var r codeResponse
+	for i := 0; i < b.N; i++ {
+		buf.Write(codeJSON)
+		// hide EOF
+		buf.WriteByte('\n')
+		buf.WriteByte('\n')
+		buf.WriteByte('\n')
+		if err := dec.Decode(&r); err != nil {
+			b.Fatal("Decode:", err)
+		}
+	}
+	b.SetBytes(int64(len(codeJSON)))
+}
+
+func BenchmarkDecoderStream(b *testing.B) {
+	b.StopTimer()
+	var buf bytes.Buffer
+	dec := NewDecoder(&buf)
+	buf.WriteString(`"` + strings.Repeat("x", 1000000) + `"` + "\n\n\n")
+	var x interface{}
+	if err := dec.Decode(&x); err != nil {
+		b.Fatal("Decode:", err)
+	}
+	ones := strings.Repeat(" 1\n", 300000) + "\n\n\n"
+	b.StartTimer()
+	for i := 0; i < b.N; i++ {
+		if i%300000 == 0 {
+			buf.WriteString(ones)
+		}
+		x = nil
+		if err := dec.Decode(&x); err != nil || x != 1.0 {
+			b.Fatalf("Decode: %v after %d", err, i)
+		}
+	}
+}
+
+func BenchmarkCodeUnmarshal(b *testing.B) {
+	if codeJSON == nil {
+		b.StopTimer()
+		codeInit()
+		b.StartTimer()
+	}
+	for i := 0; i < b.N; i++ {
+		var r codeResponse
+		if err := Unmarshal(codeJSON, &r); err != nil {
+			b.Fatal("Unmmarshal:", err)
+		}
+	}
+	b.SetBytes(int64(len(codeJSON)))
+}
+
+func BenchmarkCodeUnmarshalReuse(b *testing.B) {
+	if codeJSON == nil {
+		b.StopTimer()
+		codeInit()
+		b.StartTimer()
+	}
+	var r codeResponse
+	for i := 0; i < b.N; i++ {
+		if err := Unmarshal(codeJSON, &r); err != nil {
+			b.Fatal("Unmmarshal:", err)
+		}
+	}
+}
+
+func BenchmarkUnmarshalString(b *testing.B) {
+	data := []byte(`"hello, world"`)
+	var s string
+
+	for i := 0; i < b.N; i++ {
+		if err := Unmarshal(data, &s); err != nil {
+			b.Fatal("Unmarshal:", err)
+		}
+	}
+}
+
+func BenchmarkUnmarshalFloat64(b *testing.B) {
+	var f float64
+	data := []byte(`3.14`)
+
+	for i := 0; i < b.N; i++ {
+		if err := Unmarshal(data, &f); err != nil {
+			b.Fatal("Unmarshal:", err)
+		}
+	}
+}
+
+func BenchmarkUnmarshalInt64(b *testing.B) {
+	var x int64
+	data := []byte(`3`)
+
+	for i := 0; i < b.N; i++ {
+		if err := Unmarshal(data, &x); err != nil {
+			b.Fatal("Unmarshal:", err)
+		}
+	}
+}
+
+func BenchmarkIssue10335(b *testing.B) {
+	b.ReportAllocs()
+	var s struct{}
+	j := []byte(`{"a":{ }}`)
+	for n := 0; n < b.N; n++ {
+		if err := Unmarshal(j, &s); err != nil {
+			b.Fatal(err)
+		}
+	}
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/json/decode.go b/vendor/gopkg.in/square/go-jose.v2/json/decode.go
new file mode 100644
index 0000000..37457e5
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/json/decode.go
@@ -0,0 +1,1183 @@
+// Copyright 2010 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Represents JSON data structure using native Go types: booleans, floats,
+// strings, arrays, and maps.
+
+package json
+
+import (
+	"bytes"
+	"encoding"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"reflect"
+	"runtime"
+	"strconv"
+	"unicode"
+	"unicode/utf16"
+	"unicode/utf8"
+)
+
+// Unmarshal parses the JSON-encoded data and stores the result
+// in the value pointed to by v.
+//
+// Unmarshal uses the inverse of the encodings that
+// Marshal uses, allocating maps, slices, and pointers as necessary,
+// with the following additional rules:
+//
+// To unmarshal JSON into a pointer, Unmarshal first handles the case of
+// the JSON being the JSON literal null.  In that case, Unmarshal sets
+// the pointer to nil.  Otherwise, Unmarshal unmarshals the JSON into
+// the value pointed at by the pointer.  If the pointer is nil, Unmarshal
+// allocates a new value for it to point to.
+//
+// To unmarshal JSON into a struct, Unmarshal matches incoming object
+// keys to the keys used by Marshal (either the struct field name or its tag),
+// preferring an exact match but also accepting a case-insensitive match.
+// Unmarshal will only set exported fields of the struct.
+//
+// To unmarshal JSON into an interface value,
+// Unmarshal stores one of these in the interface value:
+//
+//	bool, for JSON booleans
+//	float64, for JSON numbers
+//	string, for JSON strings
+//	[]interface{}, for JSON arrays
+//	map[string]interface{}, for JSON objects
+//	nil for JSON null
+//
+// To unmarshal a JSON array into a slice, Unmarshal resets the slice length
+// to zero and then appends each element to the slice.
+// As a special case, to unmarshal an empty JSON array into a slice,
+// Unmarshal replaces the slice with a new empty slice.
+//
+// To unmarshal a JSON array into a Go array, Unmarshal decodes
+// JSON array elements into corresponding Go array elements.
+// If the Go array is smaller than the JSON array,
+// the additional JSON array elements are discarded.
+// If the JSON array is smaller than the Go array,
+// the additional Go array elements are set to zero values.
+//
+// To unmarshal a JSON object into a string-keyed map, Unmarshal first
+// establishes a map to use, If the map is nil, Unmarshal allocates a new map.
+// Otherwise Unmarshal reuses the existing map, keeping existing entries.
+// Unmarshal then stores key-value pairs from the JSON object into the map.
+//
+// If a JSON value is not appropriate for a given target type,
+// or if a JSON number overflows the target type, Unmarshal
+// skips that field and completes the unmarshaling as best it can.
+// If no more serious errors are encountered, Unmarshal returns
+// an UnmarshalTypeError describing the earliest such error.
+//
+// The JSON null value unmarshals into an interface, map, pointer, or slice
+// by setting that Go value to nil. Because null is often used in JSON to mean
+// ``not present,'' unmarshaling a JSON null into any other Go type has no effect
+// on the value and produces no error.
+//
+// When unmarshaling quoted strings, invalid UTF-8 or
+// invalid UTF-16 surrogate pairs are not treated as an error.
+// Instead, they are replaced by the Unicode replacement
+// character U+FFFD.
+//
+func Unmarshal(data []byte, v interface{}) error {
+	// Check for well-formedness.
+	// Avoids filling out half a data structure
+	// before discovering a JSON syntax error.
+	var d decodeState
+	err := checkValid(data, &d.scan)
+	if err != nil {
+		return err
+	}
+
+	d.init(data)
+	return d.unmarshal(v)
+}
+
+// Unmarshaler is the interface implemented by objects
+// that can unmarshal a JSON description of themselves.
+// The input can be assumed to be a valid encoding of
+// a JSON value. UnmarshalJSON must copy the JSON data
+// if it wishes to retain the data after returning.
+type Unmarshaler interface {
+	UnmarshalJSON([]byte) error
+}
+
+// An UnmarshalTypeError describes a JSON value that was
+// not appropriate for a value of a specific Go type.
+type UnmarshalTypeError struct {
+	Value  string       // description of JSON value - "bool", "array", "number -5"
+	Type   reflect.Type // type of Go value it could not be assigned to
+	Offset int64        // error occurred after reading Offset bytes
+}
+
+func (e *UnmarshalTypeError) Error() string {
+	return "json: cannot unmarshal " + e.Value + " into Go value of type " + e.Type.String()
+}
+
+// An UnmarshalFieldError describes a JSON object key that
+// led to an unexported (and therefore unwritable) struct field.
+// (No longer used; kept for compatibility.)
+type UnmarshalFieldError struct {
+	Key   string
+	Type  reflect.Type
+	Field reflect.StructField
+}
+
+func (e *UnmarshalFieldError) Error() string {
+	return "json: cannot unmarshal object key " + strconv.Quote(e.Key) + " into unexported field " + e.Field.Name + " of type " + e.Type.String()
+}
+
+// An InvalidUnmarshalError describes an invalid argument passed to Unmarshal.
+// (The argument to Unmarshal must be a non-nil pointer.)
+type InvalidUnmarshalError struct {
+	Type reflect.Type
+}
+
+func (e *InvalidUnmarshalError) Error() string {
+	if e.Type == nil {
+		return "json: Unmarshal(nil)"
+	}
+
+	if e.Type.Kind() != reflect.Ptr {
+		return "json: Unmarshal(non-pointer " + e.Type.String() + ")"
+	}
+	return "json: Unmarshal(nil " + e.Type.String() + ")"
+}
+
+func (d *decodeState) unmarshal(v interface{}) (err error) {
+	defer func() {
+		if r := recover(); r != nil {
+			if _, ok := r.(runtime.Error); ok {
+				panic(r)
+			}
+			err = r.(error)
+		}
+	}()
+
+	rv := reflect.ValueOf(v)
+	if rv.Kind() != reflect.Ptr || rv.IsNil() {
+		return &InvalidUnmarshalError{reflect.TypeOf(v)}
+	}
+
+	d.scan.reset()
+	// We decode rv not rv.Elem because the Unmarshaler interface
+	// test must be applied at the top level of the value.
+	d.value(rv)
+	return d.savedError
+}
+
+// A Number represents a JSON number literal.
+type Number string
+
+// String returns the literal text of the number.
+func (n Number) String() string { return string(n) }
+
+// Float64 returns the number as a float64.
+func (n Number) Float64() (float64, error) {
+	return strconv.ParseFloat(string(n), 64)
+}
+
+// Int64 returns the number as an int64.
+func (n Number) Int64() (int64, error) {
+	return strconv.ParseInt(string(n), 10, 64)
+}
+
+// isValidNumber reports whether s is a valid JSON number literal.
+func isValidNumber(s string) bool {
+	// This function implements the JSON numbers grammar.
+	// See https://tools.ietf.org/html/rfc7159#section-6
+	// and http://json.org/number.gif
+
+	if s == "" {
+		return false
+	}
+
+	// Optional -
+	if s[0] == '-' {
+		s = s[1:]
+		if s == "" {
+			return false
+		}
+	}
+
+	// Digits
+	switch {
+	default:
+		return false
+
+	case s[0] == '0':
+		s = s[1:]
+
+	case '1' <= s[0] && s[0] <= '9':
+		s = s[1:]
+		for len(s) > 0 && '0' <= s[0] && s[0] <= '9' {
+			s = s[1:]
+		}
+	}
+
+	// . followed by 1 or more digits.
+	if len(s) >= 2 && s[0] == '.' && '0' <= s[1] && s[1] <= '9' {
+		s = s[2:]
+		for len(s) > 0 && '0' <= s[0] && s[0] <= '9' {
+			s = s[1:]
+		}
+	}
+
+	// e or E followed by an optional - or + and
+	// 1 or more digits.
+	if len(s) >= 2 && (s[0] == 'e' || s[0] == 'E') {
+		s = s[1:]
+		if s[0] == '+' || s[0] == '-' {
+			s = s[1:]
+			if s == "" {
+				return false
+			}
+		}
+		for len(s) > 0 && '0' <= s[0] && s[0] <= '9' {
+			s = s[1:]
+		}
+	}
+
+	// Make sure we are at the end.
+	return s == ""
+}
+
+// decodeState represents the state while decoding a JSON value.
+type decodeState struct {
+	data       []byte
+	off        int // read offset in data
+	scan       scanner
+	nextscan   scanner // for calls to nextValue
+	savedError error
+	useNumber  bool
+}
+
+// errPhase is used for errors that should not happen unless
+// there is a bug in the JSON decoder or something is editing
+// the data slice while the decoder executes.
+var errPhase = errors.New("JSON decoder out of sync - data changing underfoot?")
+
+func (d *decodeState) init(data []byte) *decodeState {
+	d.data = data
+	d.off = 0
+	d.savedError = nil
+	return d
+}
+
+// error aborts the decoding by panicking with err.
+func (d *decodeState) error(err error) {
+	panic(err)
+}
+
+// saveError saves the first err it is called with,
+// for reporting at the end of the unmarshal.
+func (d *decodeState) saveError(err error) {
+	if d.savedError == nil {
+		d.savedError = err
+	}
+}
+
+// next cuts off and returns the next full JSON value in d.data[d.off:].
+// The next value is known to be an object or array, not a literal.
+func (d *decodeState) next() []byte {
+	c := d.data[d.off]
+	item, rest, err := nextValue(d.data[d.off:], &d.nextscan)
+	if err != nil {
+		d.error(err)
+	}
+	d.off = len(d.data) - len(rest)
+
+	// Our scanner has seen the opening brace/bracket
+	// and thinks we're still in the middle of the object.
+	// invent a closing brace/bracket to get it out.
+	if c == '{' {
+		d.scan.step(&d.scan, '}')
+	} else {
+		d.scan.step(&d.scan, ']')
+	}
+
+	return item
+}
+
+// scanWhile processes bytes in d.data[d.off:] until it
+// receives a scan code not equal to op.
+// It updates d.off and returns the new scan code.
+func (d *decodeState) scanWhile(op int) int {
+	var newOp int
+	for {
+		if d.off >= len(d.data) {
+			newOp = d.scan.eof()
+			d.off = len(d.data) + 1 // mark processed EOF with len+1
+		} else {
+			c := d.data[d.off]
+			d.off++
+			newOp = d.scan.step(&d.scan, c)
+		}
+		if newOp != op {
+			break
+		}
+	}
+	return newOp
+}
+
+// value decodes a JSON value from d.data[d.off:] into the value.
+// it updates d.off to point past the decoded value.
+func (d *decodeState) value(v reflect.Value) {
+	if !v.IsValid() {
+		_, rest, err := nextValue(d.data[d.off:], &d.nextscan)
+		if err != nil {
+			d.error(err)
+		}
+		d.off = len(d.data) - len(rest)
+
+		// d.scan thinks we're still at the beginning of the item.
+		// Feed in an empty string - the shortest, simplest value -
+		// so that it knows we got to the end of the value.
+		if d.scan.redo {
+			// rewind.
+			d.scan.redo = false
+			d.scan.step = stateBeginValue
+		}
+		d.scan.step(&d.scan, '"')
+		d.scan.step(&d.scan, '"')
+
+		n := len(d.scan.parseState)
+		if n > 0 && d.scan.parseState[n-1] == parseObjectKey {
+			// d.scan thinks we just read an object key; finish the object
+			d.scan.step(&d.scan, ':')
+			d.scan.step(&d.scan, '"')
+			d.scan.step(&d.scan, '"')
+			d.scan.step(&d.scan, '}')
+		}
+
+		return
+	}
+
+	switch op := d.scanWhile(scanSkipSpace); op {
+	default:
+		d.error(errPhase)
+
+	case scanBeginArray:
+		d.array(v)
+
+	case scanBeginObject:
+		d.object(v)
+
+	case scanBeginLiteral:
+		d.literal(v)
+	}
+}
+
+type unquotedValue struct{}
+
+// valueQuoted is like value but decodes a
+// quoted string literal or literal null into an interface value.
+// If it finds anything other than a quoted string literal or null,
+// valueQuoted returns unquotedValue{}.
+func (d *decodeState) valueQuoted() interface{} {
+	switch op := d.scanWhile(scanSkipSpace); op {
+	default:
+		d.error(errPhase)
+
+	case scanBeginArray:
+		d.array(reflect.Value{})
+
+	case scanBeginObject:
+		d.object(reflect.Value{})
+
+	case scanBeginLiteral:
+		switch v := d.literalInterface().(type) {
+		case nil, string:
+			return v
+		}
+	}
+	return unquotedValue{}
+}
+
+// indirect walks down v allocating pointers as needed,
+// until it gets to a non-pointer.
+// if it encounters an Unmarshaler, indirect stops and returns that.
+// if decodingNull is true, indirect stops at the last pointer so it can be set to nil.
+func (d *decodeState) indirect(v reflect.Value, decodingNull bool) (Unmarshaler, encoding.TextUnmarshaler, reflect.Value) {
+	// If v is a named type and is addressable,
+	// start with its address, so that if the type has pointer methods,
+	// we find them.
+	if v.Kind() != reflect.Ptr && v.Type().Name() != "" && v.CanAddr() {
+		v = v.Addr()
+	}
+	for {
+		// Load value from interface, but only if the result will be
+		// usefully addressable.
+		if v.Kind() == reflect.Interface && !v.IsNil() {
+			e := v.Elem()
+			if e.Kind() == reflect.Ptr && !e.IsNil() && (!decodingNull || e.Elem().Kind() == reflect.Ptr) {
+				v = e
+				continue
+			}
+		}
+
+		if v.Kind() != reflect.Ptr {
+			break
+		}
+
+		if v.Elem().Kind() != reflect.Ptr && decodingNull && v.CanSet() {
+			break
+		}
+		if v.IsNil() {
+			v.Set(reflect.New(v.Type().Elem()))
+		}
+		if v.Type().NumMethod() > 0 {
+			if u, ok := v.Interface().(Unmarshaler); ok {
+				return u, nil, reflect.Value{}
+			}
+			if u, ok := v.Interface().(encoding.TextUnmarshaler); ok {
+				return nil, u, reflect.Value{}
+			}
+		}
+		v = v.Elem()
+	}
+	return nil, nil, v
+}
+
+// array consumes an array from d.data[d.off-1:], decoding into the value v.
+// the first byte of the array ('[') has been read already.
+func (d *decodeState) array(v reflect.Value) {
+	// Check for unmarshaler.
+	u, ut, pv := d.indirect(v, false)
+	if u != nil {
+		d.off--
+		err := u.UnmarshalJSON(d.next())
+		if err != nil {
+			d.error(err)
+		}
+		return
+	}
+	if ut != nil {
+		d.saveError(&UnmarshalTypeError{"array", v.Type(), int64(d.off)})
+		d.off--
+		d.next()
+		return
+	}
+
+	v = pv
+
+	// Check type of target.
+	switch v.Kind() {
+	case reflect.Interface:
+		if v.NumMethod() == 0 {
+			// Decoding into nil interface?  Switch to non-reflect code.
+			v.Set(reflect.ValueOf(d.arrayInterface()))
+			return
+		}
+		// Otherwise it's invalid.
+		fallthrough
+	default:
+		d.saveError(&UnmarshalTypeError{"array", v.Type(), int64(d.off)})
+		d.off--
+		d.next()
+		return
+	case reflect.Array:
+	case reflect.Slice:
+		break
+	}
+
+	i := 0
+	for {
+		// Look ahead for ] - can only happen on first iteration.
+		op := d.scanWhile(scanSkipSpace)
+		if op == scanEndArray {
+			break
+		}
+
+		// Back up so d.value can have the byte we just read.
+		d.off--
+		d.scan.undo(op)
+
+		// Get element of array, growing if necessary.
+		if v.Kind() == reflect.Slice {
+			// Grow slice if necessary
+			if i >= v.Cap() {
+				newcap := v.Cap() + v.Cap()/2
+				if newcap < 4 {
+					newcap = 4
+				}
+				newv := reflect.MakeSlice(v.Type(), v.Len(), newcap)
+				reflect.Copy(newv, v)
+				v.Set(newv)
+			}
+			if i >= v.Len() {
+				v.SetLen(i + 1)
+			}
+		}
+
+		if i < v.Len() {
+			// Decode into element.
+			d.value(v.Index(i))
+		} else {
+			// Ran out of fixed array: skip.
+			d.value(reflect.Value{})
+		}
+		i++
+
+		// Next token must be , or ].
+		op = d.scanWhile(scanSkipSpace)
+		if op == scanEndArray {
+			break
+		}
+		if op != scanArrayValue {
+			d.error(errPhase)
+		}
+	}
+
+	if i < v.Len() {
+		if v.Kind() == reflect.Array {
+			// Array.  Zero the rest.
+			z := reflect.Zero(v.Type().Elem())
+			for ; i < v.Len(); i++ {
+				v.Index(i).Set(z)
+			}
+		} else {
+			v.SetLen(i)
+		}
+	}
+	if i == 0 && v.Kind() == reflect.Slice {
+		v.Set(reflect.MakeSlice(v.Type(), 0, 0))
+	}
+}
+
+var nullLiteral = []byte("null")
+
+// object consumes an object from d.data[d.off-1:], decoding into the value v.
+// the first byte ('{') of the object has been read already.
+func (d *decodeState) object(v reflect.Value) {
+	// Check for unmarshaler.
+	u, ut, pv := d.indirect(v, false)
+	if u != nil {
+		d.off--
+		err := u.UnmarshalJSON(d.next())
+		if err != nil {
+			d.error(err)
+		}
+		return
+	}
+	if ut != nil {
+		d.saveError(&UnmarshalTypeError{"object", v.Type(), int64(d.off)})
+		d.off--
+		d.next() // skip over { } in input
+		return
+	}
+	v = pv
+
+	// Decoding into nil interface?  Switch to non-reflect code.
+	if v.Kind() == reflect.Interface && v.NumMethod() == 0 {
+		v.Set(reflect.ValueOf(d.objectInterface()))
+		return
+	}
+
+	// Check type of target: struct or map[string]T
+	switch v.Kind() {
+	case reflect.Map:
+		// map must have string kind
+		t := v.Type()
+		if t.Key().Kind() != reflect.String {
+			d.saveError(&UnmarshalTypeError{"object", v.Type(), int64(d.off)})
+			d.off--
+			d.next() // skip over { } in input
+			return
+		}
+		if v.IsNil() {
+			v.Set(reflect.MakeMap(t))
+		}
+	case reflect.Struct:
+
+	default:
+		d.saveError(&UnmarshalTypeError{"object", v.Type(), int64(d.off)})
+		d.off--
+		d.next() // skip over { } in input
+		return
+	}
+
+	var mapElem reflect.Value
+	keys := map[string]bool{}
+
+	for {
+		// Read opening " of string key or closing }.
+		op := d.scanWhile(scanSkipSpace)
+		if op == scanEndObject {
+			// closing } - can only happen on first iteration.
+			break
+		}
+		if op != scanBeginLiteral {
+			d.error(errPhase)
+		}
+
+		// Read key.
+		start := d.off - 1
+		op = d.scanWhile(scanContinue)
+		item := d.data[start : d.off-1]
+		key, ok := unquote(item)
+		if !ok {
+			d.error(errPhase)
+		}
+
+		// Check for duplicate keys.
+		_, ok = keys[key]
+		if !ok {
+			keys[key] = true
+		} else {
+			d.error(fmt.Errorf("json: duplicate key '%s' in object", key))
+		}
+
+		// Figure out field corresponding to key.
+		var subv reflect.Value
+		destring := false // whether the value is wrapped in a string to be decoded first
+
+		if v.Kind() == reflect.Map {
+			elemType := v.Type().Elem()
+			if !mapElem.IsValid() {
+				mapElem = reflect.New(elemType).Elem()
+			} else {
+				mapElem.Set(reflect.Zero(elemType))
+			}
+			subv = mapElem
+		} else {
+			var f *field
+			fields := cachedTypeFields(v.Type())
+			for i := range fields {
+				ff := &fields[i]
+				if bytes.Equal(ff.nameBytes, []byte(key)) {
+					f = ff
+					break
+				}
+			}
+			if f != nil {
+				subv = v
+				destring = f.quoted
+				for _, i := range f.index {
+					if subv.Kind() == reflect.Ptr {
+						if subv.IsNil() {
+							subv.Set(reflect.New(subv.Type().Elem()))
+						}
+						subv = subv.Elem()
+					}
+					subv = subv.Field(i)
+				}
+			}
+		}
+
+		// Read : before value.
+		if op == scanSkipSpace {
+			op = d.scanWhile(scanSkipSpace)
+		}
+		if op != scanObjectKey {
+			d.error(errPhase)
+		}
+
+		// Read value.
+		if destring {
+			switch qv := d.valueQuoted().(type) {
+			case nil:
+				d.literalStore(nullLiteral, subv, false)
+			case string:
+				d.literalStore([]byte(qv), subv, true)
+			default:
+				d.saveError(fmt.Errorf("json: invalid use of ,string struct tag, trying to unmarshal unquoted value into %v", subv.Type()))
+			}
+		} else {
+			d.value(subv)
+		}
+
+		// Write value back to map;
+		// if using struct, subv points into struct already.
+		if v.Kind() == reflect.Map {
+			kv := reflect.ValueOf(key).Convert(v.Type().Key())
+			v.SetMapIndex(kv, subv)
+		}
+
+		// Next token must be , or }.
+		op = d.scanWhile(scanSkipSpace)
+		if op == scanEndObject {
+			break
+		}
+		if op != scanObjectValue {
+			d.error(errPhase)
+		}
+	}
+}
+
+// literal consumes a literal from d.data[d.off-1:], decoding into the value v.
+// The first byte of the literal has been read already
+// (that's how the caller knows it's a literal).
+func (d *decodeState) literal(v reflect.Value) {
+	// All bytes inside literal return scanContinue op code.
+	start := d.off - 1
+	op := d.scanWhile(scanContinue)
+
+	// Scan read one byte too far; back up.
+	d.off--
+	d.scan.undo(op)
+
+	d.literalStore(d.data[start:d.off], v, false)
+}
+
+// convertNumber converts the number literal s to a float64 or a Number
+// depending on the setting of d.useNumber.
+func (d *decodeState) convertNumber(s string) (interface{}, error) {
+	if d.useNumber {
+		return Number(s), nil
+	}
+	f, err := strconv.ParseFloat(s, 64)
+	if err != nil {
+		return nil, &UnmarshalTypeError{"number " + s, reflect.TypeOf(0.0), int64(d.off)}
+	}
+	return f, nil
+}
+
+var numberType = reflect.TypeOf(Number(""))
+
+// literalStore decodes a literal stored in item into v.
+//
+// fromQuoted indicates whether this literal came from unwrapping a
+// string from the ",string" struct tag option. this is used only to
+// produce more helpful error messages.
+func (d *decodeState) literalStore(item []byte, v reflect.Value, fromQuoted bool) {
+	// Check for unmarshaler.
+	if len(item) == 0 {
+		//Empty string given
+		d.saveError(fmt.Errorf("json: invalid use of ,string struct tag, trying to unmarshal %q into %v", item, v.Type()))
+		return
+	}
+	wantptr := item[0] == 'n' // null
+	u, ut, pv := d.indirect(v, wantptr)
+	if u != nil {
+		err := u.UnmarshalJSON(item)
+		if err != nil {
+			d.error(err)
+		}
+		return
+	}
+	if ut != nil {
+		if item[0] != '"' {
+			if fromQuoted {
+				d.saveError(fmt.Errorf("json: invalid use of ,string struct tag, trying to unmarshal %q into %v", item, v.Type()))
+			} else {
+				d.saveError(&UnmarshalTypeError{"string", v.Type(), int64(d.off)})
+			}
+			return
+		}
+		s, ok := unquoteBytes(item)
+		if !ok {
+			if fromQuoted {
+				d.error(fmt.Errorf("json: invalid use of ,string struct tag, trying to unmarshal %q into %v", item, v.Type()))
+			} else {
+				d.error(errPhase)
+			}
+		}
+		err := ut.UnmarshalText(s)
+		if err != nil {
+			d.error(err)
+		}
+		return
+	}
+
+	v = pv
+
+	switch c := item[0]; c {
+	case 'n': // null
+		switch v.Kind() {
+		case reflect.Interface, reflect.Ptr, reflect.Map, reflect.Slice:
+			v.Set(reflect.Zero(v.Type()))
+			// otherwise, ignore null for primitives/string
+		}
+	case 't', 'f': // true, false
+		value := c == 't'
+		switch v.Kind() {
+		default:
+			if fromQuoted {
+				d.saveError(fmt.Errorf("json: invalid use of ,string struct tag, trying to unmarshal %q into %v", item, v.Type()))
+			} else {
+				d.saveError(&UnmarshalTypeError{"bool", v.Type(), int64(d.off)})
+			}
+		case reflect.Bool:
+			v.SetBool(value)
+		case reflect.Interface:
+			if v.NumMethod() == 0 {
+				v.Set(reflect.ValueOf(value))
+			} else {
+				d.saveError(&UnmarshalTypeError{"bool", v.Type(), int64(d.off)})
+			}
+		}
+
+	case '"': // string
+		s, ok := unquoteBytes(item)
+		if !ok {
+			if fromQuoted {
+				d.error(fmt.Errorf("json: invalid use of ,string struct tag, trying to unmarshal %q into %v", item, v.Type()))
+			} else {
+				d.error(errPhase)
+			}
+		}
+		switch v.Kind() {
+		default:
+			d.saveError(&UnmarshalTypeError{"string", v.Type(), int64(d.off)})
+		case reflect.Slice:
+			if v.Type().Elem().Kind() != reflect.Uint8 {
+				d.saveError(&UnmarshalTypeError{"string", v.Type(), int64(d.off)})
+				break
+			}
+			b := make([]byte, base64.StdEncoding.DecodedLen(len(s)))
+			n, err := base64.StdEncoding.Decode(b, s)
+			if err != nil {
+				d.saveError(err)
+				break
+			}
+			v.SetBytes(b[:n])
+		case reflect.String:
+			v.SetString(string(s))
+		case reflect.Interface:
+			if v.NumMethod() == 0 {
+				v.Set(reflect.ValueOf(string(s)))
+			} else {
+				d.saveError(&UnmarshalTypeError{"string", v.Type(), int64(d.off)})
+			}
+		}
+
+	default: // number
+		if c != '-' && (c < '0' || c > '9') {
+			if fromQuoted {
+				d.error(fmt.Errorf("json: invalid use of ,string struct tag, trying to unmarshal %q into %v", item, v.Type()))
+			} else {
+				d.error(errPhase)
+			}
+		}
+		s := string(item)
+		switch v.Kind() {
+		default:
+			if v.Kind() == reflect.String && v.Type() == numberType {
+				v.SetString(s)
+				if !isValidNumber(s) {
+					d.error(fmt.Errorf("json: invalid number literal, trying to unmarshal %q into Number", item))
+				}
+				break
+			}
+			if fromQuoted {
+				d.error(fmt.Errorf("json: invalid use of ,string struct tag, trying to unmarshal %q into %v", item, v.Type()))
+			} else {
+				d.error(&UnmarshalTypeError{"number", v.Type(), int64(d.off)})
+			}
+		case reflect.Interface:
+			n, err := d.convertNumber(s)
+			if err != nil {
+				d.saveError(err)
+				break
+			}
+			if v.NumMethod() != 0 {
+				d.saveError(&UnmarshalTypeError{"number", v.Type(), int64(d.off)})
+				break
+			}
+			v.Set(reflect.ValueOf(n))
+
+		case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+			n, err := strconv.ParseInt(s, 10, 64)
+			if err != nil || v.OverflowInt(n) {
+				d.saveError(&UnmarshalTypeError{"number " + s, v.Type(), int64(d.off)})
+				break
+			}
+			v.SetInt(n)
+
+		case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
+			n, err := strconv.ParseUint(s, 10, 64)
+			if err != nil || v.OverflowUint(n) {
+				d.saveError(&UnmarshalTypeError{"number " + s, v.Type(), int64(d.off)})
+				break
+			}
+			v.SetUint(n)
+
+		case reflect.Float32, reflect.Float64:
+			n, err := strconv.ParseFloat(s, v.Type().Bits())
+			if err != nil || v.OverflowFloat(n) {
+				d.saveError(&UnmarshalTypeError{"number " + s, v.Type(), int64(d.off)})
+				break
+			}
+			v.SetFloat(n)
+		}
+	}
+}
+
+// The xxxInterface routines build up a value to be stored
+// in an empty interface.  They are not strictly necessary,
+// but they avoid the weight of reflection in this common case.
+
+// valueInterface is like value but returns interface{}
+func (d *decodeState) valueInterface() interface{} {
+	switch d.scanWhile(scanSkipSpace) {
+	default:
+		d.error(errPhase)
+		panic("unreachable")
+	case scanBeginArray:
+		return d.arrayInterface()
+	case scanBeginObject:
+		return d.objectInterface()
+	case scanBeginLiteral:
+		return d.literalInterface()
+	}
+}
+
+// arrayInterface is like array but returns []interface{}.
+func (d *decodeState) arrayInterface() []interface{} {
+	var v = make([]interface{}, 0)
+	for {
+		// Look ahead for ] - can only happen on first iteration.
+		op := d.scanWhile(scanSkipSpace)
+		if op == scanEndArray {
+			break
+		}
+
+		// Back up so d.value can have the byte we just read.
+		d.off--
+		d.scan.undo(op)
+
+		v = append(v, d.valueInterface())
+
+		// Next token must be , or ].
+		op = d.scanWhile(scanSkipSpace)
+		if op == scanEndArray {
+			break
+		}
+		if op != scanArrayValue {
+			d.error(errPhase)
+		}
+	}
+	return v
+}
+
+// objectInterface is like object but returns map[string]interface{}.
+func (d *decodeState) objectInterface() map[string]interface{} {
+	m := make(map[string]interface{})
+	keys := map[string]bool{}
+
+	for {
+		// Read opening " of string key or closing }.
+		op := d.scanWhile(scanSkipSpace)
+		if op == scanEndObject {
+			// closing } - can only happen on first iteration.
+			break
+		}
+		if op != scanBeginLiteral {
+			d.error(errPhase)
+		}
+
+		// Read string key.
+		start := d.off - 1
+		op = d.scanWhile(scanContinue)
+		item := d.data[start : d.off-1]
+		key, ok := unquote(item)
+		if !ok {
+			d.error(errPhase)
+		}
+
+		// Check for duplicate keys.
+		_, ok = keys[key]
+		if !ok {
+			keys[key] = true
+		} else {
+			d.error(fmt.Errorf("json: duplicate key '%s' in object", key))
+		}
+
+		// Read : before value.
+		if op == scanSkipSpace {
+			op = d.scanWhile(scanSkipSpace)
+		}
+		if op != scanObjectKey {
+			d.error(errPhase)
+		}
+
+		// Read value.
+		m[key] = d.valueInterface()
+
+		// Next token must be , or }.
+		op = d.scanWhile(scanSkipSpace)
+		if op == scanEndObject {
+			break
+		}
+		if op != scanObjectValue {
+			d.error(errPhase)
+		}
+	}
+	return m
+}
+
+// literalInterface is like literal but returns an interface value.
+func (d *decodeState) literalInterface() interface{} {
+	// All bytes inside literal return scanContinue op code.
+	start := d.off - 1
+	op := d.scanWhile(scanContinue)
+
+	// Scan read one byte too far; back up.
+	d.off--
+	d.scan.undo(op)
+	item := d.data[start:d.off]
+
+	switch c := item[0]; c {
+	case 'n': // null
+		return nil
+
+	case 't', 'f': // true, false
+		return c == 't'
+
+	case '"': // string
+		s, ok := unquote(item)
+		if !ok {
+			d.error(errPhase)
+		}
+		return s
+
+	default: // number
+		if c != '-' && (c < '0' || c > '9') {
+			d.error(errPhase)
+		}
+		n, err := d.convertNumber(string(item))
+		if err != nil {
+			d.saveError(err)
+		}
+		return n
+	}
+}
+
+// getu4 decodes \uXXXX from the beginning of s, returning the hex value,
+// or it returns -1.
+func getu4(s []byte) rune {
+	if len(s) < 6 || s[0] != '\\' || s[1] != 'u' {
+		return -1
+	}
+	r, err := strconv.ParseUint(string(s[2:6]), 16, 64)
+	if err != nil {
+		return -1
+	}
+	return rune(r)
+}
+
+// unquote converts a quoted JSON string literal s into an actual string t.
+// The rules are different than for Go, so cannot use strconv.Unquote.
+func unquote(s []byte) (t string, ok bool) {
+	s, ok = unquoteBytes(s)
+	t = string(s)
+	return
+}
+
+func unquoteBytes(s []byte) (t []byte, ok bool) {
+	if len(s) < 2 || s[0] != '"' || s[len(s)-1] != '"' {
+		return
+	}
+	s = s[1 : len(s)-1]
+
+	// Check for unusual characters. If there are none,
+	// then no unquoting is needed, so return a slice of the
+	// original bytes.
+	r := 0
+	for r < len(s) {
+		c := s[r]
+		if c == '\\' || c == '"' || c < ' ' {
+			break
+		}
+		if c < utf8.RuneSelf {
+			r++
+			continue
+		}
+		rr, size := utf8.DecodeRune(s[r:])
+		if rr == utf8.RuneError && size == 1 {
+			break
+		}
+		r += size
+	}
+	if r == len(s) {
+		return s, true
+	}
+
+	b := make([]byte, len(s)+2*utf8.UTFMax)
+	w := copy(b, s[0:r])
+	for r < len(s) {
+		// Out of room?  Can only happen if s is full of
+		// malformed UTF-8 and we're replacing each
+		// byte with RuneError.
+		if w >= len(b)-2*utf8.UTFMax {
+			nb := make([]byte, (len(b)+utf8.UTFMax)*2)
+			copy(nb, b[0:w])
+			b = nb
+		}
+		switch c := s[r]; {
+		case c == '\\':
+			r++
+			if r >= len(s) {
+				return
+			}
+			switch s[r] {
+			default:
+				return
+			case '"', '\\', '/', '\'':
+				b[w] = s[r]
+				r++
+				w++
+			case 'b':
+				b[w] = '\b'
+				r++
+				w++
+			case 'f':
+				b[w] = '\f'
+				r++
+				w++
+			case 'n':
+				b[w] = '\n'
+				r++
+				w++
+			case 'r':
+				b[w] = '\r'
+				r++
+				w++
+			case 't':
+				b[w] = '\t'
+				r++
+				w++
+			case 'u':
+				r--
+				rr := getu4(s[r:])
+				if rr < 0 {
+					return
+				}
+				r += 6
+				if utf16.IsSurrogate(rr) {
+					rr1 := getu4(s[r:])
+					if dec := utf16.DecodeRune(rr, rr1); dec != unicode.ReplacementChar {
+						// A valid pair; consume.
+						r += 6
+						w += utf8.EncodeRune(b[w:], dec)
+						break
+					}
+					// Invalid surrogate; fall back to replacement rune.
+					rr = unicode.ReplacementChar
+				}
+				w += utf8.EncodeRune(b[w:], rr)
+			}
+
+		// Quote, control characters are invalid.
+		case c == '"', c < ' ':
+			return
+
+		// ASCII
+		case c < utf8.RuneSelf:
+			b[w] = c
+			r++
+			w++
+
+		// Coerce to well-formed UTF-8.
+		default:
+			rr, size := utf8.DecodeRune(s[r:])
+			r += size
+			w += utf8.EncodeRune(b[w:], rr)
+		}
+	}
+	return b[0:w], true
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/json/decode_test.go b/vendor/gopkg.in/square/go-jose.v2/json/decode_test.go
new file mode 100644
index 0000000..3239465
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/json/decode_test.go
@@ -0,0 +1,1474 @@
+// Copyright 2010 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package json
+
+import (
+	"bytes"
+	"encoding"
+	"fmt"
+	"image"
+	"net"
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+)
+
+type T struct {
+	X string
+	Y int
+	Z int `json:"-"`
+}
+
+type U struct {
+	Alphabet string `json:"alpha"`
+}
+
+type V struct {
+	F1 interface{}
+	F2 int32
+	F3 Number
+}
+
+// ifaceNumAsFloat64/ifaceNumAsNumber are used to test unmarshaling with and
+// without UseNumber
+var ifaceNumAsFloat64 = map[string]interface{}{
+	"k1": float64(1),
+	"k2": "s",
+	"k3": []interface{}{float64(1), float64(2.0), float64(3e-3)},
+	"k4": map[string]interface{}{"kk1": "s", "kk2": float64(2)},
+}
+
+var ifaceNumAsNumber = map[string]interface{}{
+	"k1": Number("1"),
+	"k2": "s",
+	"k3": []interface{}{Number("1"), Number("2.0"), Number("3e-3")},
+	"k4": map[string]interface{}{"kk1": "s", "kk2": Number("2")},
+}
+
+type tx struct {
+	x int
+}
+
+// A type that can unmarshal itself.
+
+type unmarshaler struct {
+	T bool
+}
+
+func (u *unmarshaler) UnmarshalJSON(b []byte) error {
+	*u = unmarshaler{true} // All we need to see that UnmarshalJSON is called.
+	return nil
+}
+
+type ustruct struct {
+	M unmarshaler
+}
+
+type unmarshalerText struct {
+	T bool
+}
+
+// needed for re-marshaling tests
+func (u *unmarshalerText) MarshalText() ([]byte, error) {
+	return []byte(""), nil
+}
+
+func (u *unmarshalerText) UnmarshalText(b []byte) error {
+	*u = unmarshalerText{true} // All we need to see that UnmarshalText is called.
+	return nil
+}
+
+var _ encoding.TextUnmarshaler = (*unmarshalerText)(nil)
+
+type ustructText struct {
+	M unmarshalerText
+}
+
+var (
+	um0, um1 unmarshaler // target2 of unmarshaling
+	ump      = &um1
+	umtrue   = unmarshaler{true}
+	umslice  = []unmarshaler{{true}}
+	umslicep = new([]unmarshaler)
+	umstruct = ustruct{unmarshaler{true}}
+
+	um0T, um1T unmarshalerText // target2 of unmarshaling
+	umpT       = &um1T
+	umtrueT    = unmarshalerText{true}
+	umsliceT   = []unmarshalerText{{true}}
+	umslicepT  = new([]unmarshalerText)
+	umstructT  = ustructText{unmarshalerText{true}}
+)
+
+// Test data structures for anonymous fields.
+
+type Point struct {
+	Z int
+}
+
+type Top struct {
+	Level0 int
+	Embed0
+	*Embed0a
+	*Embed0b `json:"e,omitempty"` // treated as named
+	Embed0c  `json:"-"`           // ignored
+	Loop
+	Embed0p // has Point with X, Y, used
+	Embed0q // has Point with Z, used
+	embed   // contains exported field
+}
+
+type Embed0 struct {
+	Level1a int // overridden by Embed0a's Level1a with json tag
+	Level1b int // used because Embed0a's Level1b is renamed
+	Level1c int // used because Embed0a's Level1c is ignored
+	Level1d int // annihilated by Embed0a's Level1d
+	Level1e int `json:"x"` // annihilated by Embed0a.Level1e
+}
+
+type Embed0a struct {
+	Level1a int `json:"Level1a,omitempty"`
+	Level1b int `json:"LEVEL1B,omitempty"`
+	Level1c int `json:"-"`
+	Level1d int // annihilated by Embed0's Level1d
+	Level1f int `json:"x"` // annihilated by Embed0's Level1e
+}
+
+type Embed0b Embed0
+
+type Embed0c Embed0
+
+type Embed0p struct {
+	image.Point
+}
+
+type Embed0q struct {
+	Point
+}
+
+type embed struct {
+	Q int
+}
+
+type Loop struct {
+	Loop1 int `json:",omitempty"`
+	Loop2 int `json:",omitempty"`
+	*Loop
+}
+
+// From reflect test:
+// The X in S6 and S7 annihilate, but they also block the X in S8.S9.
+type S5 struct {
+	S6
+	S7
+	S8
+}
+
+type S6 struct {
+	X int
+}
+
+type S7 S6
+
+type S8 struct {
+	S9
+}
+
+type S9 struct {
+	X int
+	Y int
+}
+
+// From reflect test:
+// The X in S11.S6 and S12.S6 annihilate, but they also block the X in S13.S8.S9.
+type S10 struct {
+	S11
+	S12
+	S13
+}
+
+type S11 struct {
+	S6
+}
+
+type S12 struct {
+	S6
+}
+
+type S13 struct {
+	S8
+}
+
+type unmarshalTest struct {
+	in        string
+	ptr       interface{}
+	out       interface{}
+	err       error
+	useNumber bool
+}
+
+type XYZ struct {
+	X interface{}
+	Y interface{}
+	Z interface{}
+}
+
+func sliceAddr(x []int) *[]int                 { return &x }
+func mapAddr(x map[string]int) *map[string]int { return &x }
+
+var unmarshalTests = []unmarshalTest{
+	// basic types
+	{in: `true`, ptr: new(bool), out: true},
+	{in: `1`, ptr: new(int), out: 1},
+	{in: `1.2`, ptr: new(float64), out: 1.2},
+	{in: `-5`, ptr: new(int16), out: int16(-5)},
+	{in: `2`, ptr: new(Number), out: Number("2"), useNumber: true},
+	{in: `2`, ptr: new(Number), out: Number("2")},
+	{in: `2`, ptr: new(interface{}), out: float64(2.0)},
+	{in: `2`, ptr: new(interface{}), out: Number("2"), useNumber: true},
+	{in: `"a\u1234"`, ptr: new(string), out: "a\u1234"},
+	{in: `"http:\/\/"`, ptr: new(string), out: "http://"},
+	{in: `"g-clef: \uD834\uDD1E"`, ptr: new(string), out: "g-clef: \U0001D11E"},
+	{in: `"invalid: \uD834x\uDD1E"`, ptr: new(string), out: "invalid: \uFFFDx\uFFFD"},
+	{in: "null", ptr: new(interface{}), out: nil},
+	{in: `{"X": [1,2,3], "Y": 4}`, ptr: new(T), out: T{Y: 4}, err: &UnmarshalTypeError{"array", reflect.TypeOf(""), 7}},
+	{in: `{"x": 1}`, ptr: new(tx), out: tx{}},
+	{in: `{"F1":1,"F2":2,"F3":3}`, ptr: new(V), out: V{F1: float64(1), F2: int32(2), F3: Number("3")}},
+	{in: `{"F1":1,"F2":2,"F3":3}`, ptr: new(V), out: V{F1: Number("1"), F2: int32(2), F3: Number("3")}, useNumber: true},
+	{in: `{"k1":1,"k2":"s","k3":[1,2.0,3e-3],"k4":{"kk1":"s","kk2":2}}`, ptr: new(interface{}), out: ifaceNumAsFloat64},
+	{in: `{"k1":1,"k2":"s","k3":[1,2.0,3e-3],"k4":{"kk1":"s","kk2":2}}`, ptr: new(interface{}), out: ifaceNumAsNumber, useNumber: true},
+
+	// raw values with whitespace
+	{in: "\n true ", ptr: new(bool), out: true},
+	{in: "\t 1 ", ptr: new(int), out: 1},
+	{in: "\r 1.2 ", ptr: new(float64), out: 1.2},
+	{in: "\t -5 \n", ptr: new(int16), out: int16(-5)},
+	{in: "\t \"a\\u1234\" \n", ptr: new(string), out: "a\u1234"},
+
+	// Z has a "-" tag.
+	{in: `{"Y": 1, "Z": 2}`, ptr: new(T), out: T{Y: 1}},
+
+	{in: `{"alpha": "abc", "alphabet": "xyz"}`, ptr: new(U), out: U{Alphabet: "abc"}},
+	{in: `{"alpha": "abc"}`, ptr: new(U), out: U{Alphabet: "abc"}},
+	{in: `{"alphabet": "xyz"}`, ptr: new(U), out: U{}},
+
+	// syntax errors
+	{in: `{"X": "foo", "Y"}`, err: &SyntaxError{"invalid character '}' after object key", 17}},
+	{in: `[1, 2, 3+]`, err: &SyntaxError{"invalid character '+' after array element", 9}},
+	{in: `{"X":12x}`, err: &SyntaxError{"invalid character 'x' after object key:value pair", 8}, useNumber: true},
+
+	// raw value errors
+	{in: "\x01 42", err: &SyntaxError{"invalid character '\\x01' looking for beginning of value", 1}},
+	{in: " 42 \x01", err: &SyntaxError{"invalid character '\\x01' after top-level value", 5}},
+	{in: "\x01 true", err: &SyntaxError{"invalid character '\\x01' looking for beginning of value", 1}},
+	{in: " false \x01", err: &SyntaxError{"invalid character '\\x01' after top-level value", 8}},
+	{in: "\x01 1.2", err: &SyntaxError{"invalid character '\\x01' looking for beginning of value", 1}},
+	{in: " 3.4 \x01", err: &SyntaxError{"invalid character '\\x01' after top-level value", 6}},
+	{in: "\x01 \"string\"", err: &SyntaxError{"invalid character '\\x01' looking for beginning of value", 1}},
+	{in: " \"string\" \x01", err: &SyntaxError{"invalid character '\\x01' after top-level value", 11}},
+
+	// array tests
+	{in: `[1, 2, 3]`, ptr: new([3]int), out: [3]int{1, 2, 3}},
+	{in: `[1, 2, 3]`, ptr: new([1]int), out: [1]int{1}},
+	{in: `[1, 2, 3]`, ptr: new([5]int), out: [5]int{1, 2, 3, 0, 0}},
+
+	// empty array to interface test
+	{in: `[]`, ptr: new([]interface{}), out: []interface{}{}},
+	{in: `null`, ptr: new([]interface{}), out: []interface{}(nil)},
+	{in: `{"T":[]}`, ptr: new(map[string]interface{}), out: map[string]interface{}{"T": []interface{}{}}},
+	{in: `{"T":null}`, ptr: new(map[string]interface{}), out: map[string]interface{}{"T": interface{}(nil)}},
+
+	// composite tests
+	{in: allValueIndent, ptr: new(All), out: allValue},
+	{in: allValueCompact, ptr: new(All), out: allValue},
+	{in: allValueIndent, ptr: new(*All), out: &allValue},
+	{in: allValueCompact, ptr: new(*All), out: &allValue},
+	{in: pallValueIndent, ptr: new(All), out: pallValue},
+	{in: pallValueCompact, ptr: new(All), out: pallValue},
+	{in: pallValueIndent, ptr: new(*All), out: &pallValue},
+	{in: pallValueCompact, ptr: new(*All), out: &pallValue},
+
+	// unmarshal interface test
+	{in: `{"T":false}`, ptr: &um0, out: umtrue}, // use "false" so test will fail if custom unmarshaler is not called
+	{in: `{"T":false}`, ptr: &ump, out: &umtrue},
+	{in: `[{"T":false}]`, ptr: &umslice, out: umslice},
+	{in: `[{"T":false}]`, ptr: &umslicep, out: &umslice},
+	{in: `{"M":{"T":false}}`, ptr: &umstruct, out: umstruct},
+
+	// UnmarshalText interface test
+	{in: `"X"`, ptr: &um0T, out: umtrueT}, // use "false" so test will fail if custom unmarshaler is not called
+	{in: `"X"`, ptr: &umpT, out: &umtrueT},
+	{in: `["X"]`, ptr: &umsliceT, out: umsliceT},
+	{in: `["X"]`, ptr: &umslicepT, out: &umsliceT},
+	{in: `{"M":"X"}`, ptr: &umstructT, out: umstructT},
+
+	// Overwriting of data.
+	// This is different from package xml, but it's what we've always done.
+	// Now documented and tested.
+	{in: `[2]`, ptr: sliceAddr([]int{1}), out: []int{2}},
+	{in: `{"key": 2}`, ptr: mapAddr(map[string]int{"old": 0, "key": 1}), out: map[string]int{"key": 2}},
+
+	{
+		in: `{
+			"Level0": 1,
+			"Level1b": 2,
+			"Level1c": 3,
+			"x": 4,
+			"Level1a": 5,
+			"LEVEL1B": 6,
+			"e": {
+				"Level1a": 8,
+				"Level1b": 9,
+				"Level1c": 10,
+				"Level1d": 11,
+				"x": 12
+			},
+			"Loop1": 13,
+			"Loop2": 14,
+			"X": 15,
+			"Y": 16,
+			"Z": 17,
+			"Q": 18
+		}`,
+		ptr: new(Top),
+		out: Top{
+			Level0: 1,
+			Embed0: Embed0{
+				Level1b: 2,
+				Level1c: 3,
+			},
+			Embed0a: &Embed0a{
+				Level1a: 5,
+				Level1b: 6,
+			},
+			Embed0b: &Embed0b{
+				Level1a: 8,
+				Level1b: 9,
+				Level1c: 10,
+				Level1d: 11,
+				Level1e: 12,
+			},
+			Loop: Loop{
+				Loop1: 13,
+				Loop2: 14,
+			},
+			Embed0p: Embed0p{
+				Point: image.Point{X: 15, Y: 16},
+			},
+			Embed0q: Embed0q{
+				Point: Point{Z: 17},
+			},
+			embed: embed{
+				Q: 18,
+			},
+		},
+	},
+	{
+		in:  `{"X": 1,"Y":2}`,
+		ptr: new(S5),
+		out: S5{S8: S8{S9: S9{Y: 2}}},
+	},
+	{
+		in:  `{"X": 1,"Y":2}`,
+		ptr: new(S10),
+		out: S10{S13: S13{S8: S8{S9: S9{Y: 2}}}},
+	},
+
+	// invalid UTF-8 is coerced to valid UTF-8.
+	{
+		in:  "\"hello\xffworld\"",
+		ptr: new(string),
+		out: "hello\ufffdworld",
+	},
+	{
+		in:  "\"hello\xc2\xc2world\"",
+		ptr: new(string),
+		out: "hello\ufffd\ufffdworld",
+	},
+	{
+		in:  "\"hello\xc2\xffworld\"",
+		ptr: new(string),
+		out: "hello\ufffd\ufffdworld",
+	},
+	{
+		in:  "\"hello\\ud800world\"",
+		ptr: new(string),
+		out: "hello\ufffdworld",
+	},
+	{
+		in:  "\"hello\\ud800\\ud800world\"",
+		ptr: new(string),
+		out: "hello\ufffd\ufffdworld",
+	},
+	{
+		in:  "\"hello\\ud800\\ud800world\"",
+		ptr: new(string),
+		out: "hello\ufffd\ufffdworld",
+	},
+	{
+		in:  "\"hello\xed\xa0\x80\xed\xb0\x80world\"",
+		ptr: new(string),
+		out: "hello\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdworld",
+	},
+
+	// issue 8305
+	{
+		in:  `{"2009-11-10T23:00:00Z": "hello world"}`,
+		ptr: &map[time.Time]string{},
+		err: &UnmarshalTypeError{"object", reflect.TypeOf(map[time.Time]string{}), 1},
+	},
+}
+
+func TestMarshal(t *testing.T) {
+	b, err := Marshal(allValue)
+	if err != nil {
+		t.Fatalf("Marshal allValue: %v", err)
+	}
+	if string(b) != allValueCompact {
+		t.Errorf("Marshal allValueCompact")
+		diff(t, b, []byte(allValueCompact))
+		return
+	}
+
+	b, err = Marshal(pallValue)
+	if err != nil {
+		t.Fatalf("Marshal pallValue: %v", err)
+	}
+	if string(b) != pallValueCompact {
+		t.Errorf("Marshal pallValueCompact")
+		diff(t, b, []byte(pallValueCompact))
+		return
+	}
+}
+
+var badUTF8 = []struct {
+	in, out string
+}{
+	{"hello\xffworld", `"hello\ufffdworld"`},
+	{"", `""`},
+	{"\xff", `"\ufffd"`},
+	{"\xff\xff", `"\ufffd\ufffd"`},
+	{"a\xffb", `"a\ufffdb"`},
+	{"\xe6\x97\xa5\xe6\x9c\xac\xff\xaa\x9e", `"日本\ufffd\ufffd\ufffd"`},
+}
+
+func TestMarshalBadUTF8(t *testing.T) {
+	for _, tt := range badUTF8 {
+		b, err := Marshal(tt.in)
+		if string(b) != tt.out || err != nil {
+			t.Errorf("Marshal(%q) = %#q, %v, want %#q, nil", tt.in, b, err, tt.out)
+		}
+	}
+}
+
+func TestMarshalNumberZeroVal(t *testing.T) {
+	var n Number
+	out, err := Marshal(n)
+	if err != nil {
+		t.Fatal(err)
+	}
+	outStr := string(out)
+	if outStr != "0" {
+		t.Fatalf("Invalid zero val for Number: %q", outStr)
+	}
+}
+
+func TestMarshalEmbeds(t *testing.T) {
+	top := &Top{
+		Level0: 1,
+		Embed0: Embed0{
+			Level1b: 2,
+			Level1c: 3,
+		},
+		Embed0a: &Embed0a{
+			Level1a: 5,
+			Level1b: 6,
+		},
+		Embed0b: &Embed0b{
+			Level1a: 8,
+			Level1b: 9,
+			Level1c: 10,
+			Level1d: 11,
+			Level1e: 12,
+		},
+		Loop: Loop{
+			Loop1: 13,
+			Loop2: 14,
+		},
+		Embed0p: Embed0p{
+			Point: image.Point{X: 15, Y: 16},
+		},
+		Embed0q: Embed0q{
+			Point: Point{Z: 17},
+		},
+		embed: embed{
+			Q: 18,
+		},
+	}
+	b, err := Marshal(top)
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := "{\"Level0\":1,\"Level1b\":2,\"Level1c\":3,\"Level1a\":5,\"LEVEL1B\":6,\"e\":{\"Level1a\":8,\"Level1b\":9,\"Level1c\":10,\"Level1d\":11,\"x\":12},\"Loop1\":13,\"Loop2\":14,\"X\":15,\"Y\":16,\"Z\":17,\"Q\":18}"
+	if string(b) != want {
+		t.Errorf("Wrong marshal result.\n got: %q\nwant: %q", b, want)
+	}
+}
+
+func TestUnmarshal(t *testing.T) {
+	for i, tt := range unmarshalTests {
+		var scan scanner
+		in := []byte(tt.in)
+		if err := checkValid(in, &scan); err != nil {
+			if !reflect.DeepEqual(err, tt.err) {
+				t.Errorf("#%d: checkValid: %#v", i, err)
+				continue
+			}
+		}
+		if tt.ptr == nil {
+			continue
+		}
+
+		// v = new(right-type)
+		v := reflect.New(reflect.TypeOf(tt.ptr).Elem())
+		dec := NewDecoder(bytes.NewReader(in))
+		if tt.useNumber {
+			dec.UseNumber()
+		}
+		if err := dec.Decode(v.Interface()); !reflect.DeepEqual(err, tt.err) {
+			t.Errorf("#%d: %v, want %v", i, err, tt.err)
+			continue
+		} else if err != nil {
+			continue
+		}
+		if !reflect.DeepEqual(v.Elem().Interface(), tt.out) {
+			t.Errorf("#%d: mismatch\nhave: %#+v\nwant: %#+v", i, v.Elem().Interface(), tt.out)
+			data, _ := Marshal(v.Elem().Interface())
+			println(string(data))
+			data, _ = Marshal(tt.out)
+			println(string(data))
+			continue
+		}
+
+		// Check round trip.
+		if tt.err == nil {
+			enc, err := Marshal(v.Interface())
+			if err != nil {
+				t.Errorf("#%d: error re-marshaling: %v", i, err)
+				continue
+			}
+			vv := reflect.New(reflect.TypeOf(tt.ptr).Elem())
+			dec = NewDecoder(bytes.NewReader(enc))
+			if tt.useNumber {
+				dec.UseNumber()
+			}
+			if err := dec.Decode(vv.Interface()); err != nil {
+				t.Errorf("#%d: error re-unmarshaling %#q: %v", i, enc, err)
+				continue
+			}
+			if !reflect.DeepEqual(v.Elem().Interface(), vv.Elem().Interface()) {
+				t.Errorf("#%d: mismatch\nhave: %#+v\nwant: %#+v", i, v.Elem().Interface(), vv.Elem().Interface())
+				t.Errorf("     In: %q", strings.Map(noSpace, string(in)))
+				t.Errorf("Marshal: %q", strings.Map(noSpace, string(enc)))
+				continue
+			}
+		}
+	}
+}
+
+func TestUnmarshalMarshal(t *testing.T) {
+	initBig()
+	var v interface{}
+	if err := Unmarshal(jsonBig, &v); err != nil {
+		t.Fatalf("Unmarshal: %v", err)
+	}
+	b, err := Marshal(v)
+	if err != nil {
+		t.Fatalf("Marshal: %v", err)
+	}
+	if !bytes.Equal(jsonBig, b) {
+		t.Errorf("Marshal jsonBig")
+		diff(t, b, jsonBig)
+		return
+	}
+}
+
+var numberTests = []struct {
+	in       string
+	i        int64
+	intErr   string
+	f        float64
+	floatErr string
+}{
+	{in: "-1.23e1", intErr: "strconv.ParseInt: parsing \"-1.23e1\": invalid syntax", f: -1.23e1},
+	{in: "-12", i: -12, f: -12.0},
+	{in: "1e1000", intErr: "strconv.ParseInt: parsing \"1e1000\": invalid syntax", floatErr: "strconv.ParseFloat: parsing \"1e1000\": value out of range"},
+}
+
+// Independent of Decode, basic coverage of the accessors in Number
+func TestNumberAccessors(t *testing.T) {
+	for _, tt := range numberTests {
+		n := Number(tt.in)
+		if s := n.String(); s != tt.in {
+			t.Errorf("Number(%q).String() is %q", tt.in, s)
+		}
+		if i, err := n.Int64(); err == nil && tt.intErr == "" && i != tt.i {
+			t.Errorf("Number(%q).Int64() is %d", tt.in, i)
+		} else if (err == nil && tt.intErr != "") || (err != nil && err.Error() != tt.intErr) {
+			t.Errorf("Number(%q).Int64() wanted error %q but got: %v", tt.in, tt.intErr, err)
+		}
+		if f, err := n.Float64(); err == nil && tt.floatErr == "" && f != tt.f {
+			t.Errorf("Number(%q).Float64() is %g", tt.in, f)
+		} else if (err == nil && tt.floatErr != "") || (err != nil && err.Error() != tt.floatErr) {
+			t.Errorf("Number(%q).Float64() wanted error %q but got: %v", tt.in, tt.floatErr, err)
+		}
+	}
+}
+
+func TestLargeByteSlice(t *testing.T) {
+	s0 := make([]byte, 2000)
+	for i := range s0 {
+		s0[i] = byte(i)
+	}
+	b, err := Marshal(s0)
+	if err != nil {
+		t.Fatalf("Marshal: %v", err)
+	}
+	var s1 []byte
+	if err := Unmarshal(b, &s1); err != nil {
+		t.Fatalf("Unmarshal: %v", err)
+	}
+	if !bytes.Equal(s0, s1) {
+		t.Errorf("Marshal large byte slice")
+		diff(t, s0, s1)
+	}
+}
+
+type Xint struct {
+	X int
+}
+
+func TestUnmarshalInterface(t *testing.T) {
+	var xint Xint
+	var i interface{} = &xint
+	if err := Unmarshal([]byte(`{"X":1}`), &i); err != nil {
+		t.Fatalf("Unmarshal: %v", err)
+	}
+	if xint.X != 1 {
+		t.Fatalf("Did not write to xint")
+	}
+}
+
+func TestUnmarshalPtrPtr(t *testing.T) {
+	var xint Xint
+	pxint := &xint
+	if err := Unmarshal([]byte(`{"X":1}`), &pxint); err != nil {
+		t.Fatalf("Unmarshal: %v", err)
+	}
+	if xint.X != 1 {
+		t.Fatalf("Did not write to xint")
+	}
+}
+
+func TestEscape(t *testing.T) {
+	const input = `"foobar"<html>` + " [\u2028 \u2029]"
+	const expected = `"\"foobar\"\u003chtml\u003e [\u2028 \u2029]"`
+	b, err := Marshal(input)
+	if err != nil {
+		t.Fatalf("Marshal error: %v", err)
+	}
+	if s := string(b); s != expected {
+		t.Errorf("Encoding of [%s]:\n got [%s]\nwant [%s]", input, s, expected)
+	}
+}
+
+// WrongString is a struct that's misusing the ,string modifier.
+type WrongString struct {
+	Message string `json:"result,string"`
+}
+
+type wrongStringTest struct {
+	in, err string
+}
+
+var wrongStringTests = []wrongStringTest{
+	{`{"result":"x"}`, `json: invalid use of ,string struct tag, trying to unmarshal "x" into string`},
+	{`{"result":"foo"}`, `json: invalid use of ,string struct tag, trying to unmarshal "foo" into string`},
+	{`{"result":"123"}`, `json: invalid use of ,string struct tag, trying to unmarshal "123" into string`},
+	{`{"result":123}`, `json: invalid use of ,string struct tag, trying to unmarshal unquoted value into string`},
+}
+
+// If people misuse the ,string modifier, the error message should be
+// helpful, telling the user that they're doing it wrong.
+func TestErrorMessageFromMisusedString(t *testing.T) {
+	for n, tt := range wrongStringTests {
+		r := strings.NewReader(tt.in)
+		var s WrongString
+		err := NewDecoder(r).Decode(&s)
+		got := fmt.Sprintf("%v", err)
+		if got != tt.err {
+			t.Errorf("%d. got err = %q, want %q", n, got, tt.err)
+		}
+	}
+}
+
+func noSpace(c rune) rune {
+	if isSpace(byte(c)) { //only used for ascii
+		return -1
+	}
+	return c
+}
+
+type All struct {
+	Bool    bool
+	Int     int
+	Int8    int8
+	Int16   int16
+	Int32   int32
+	Int64   int64
+	Uint    uint
+	Uint8   uint8
+	Uint16  uint16
+	Uint32  uint32
+	Uint64  uint64
+	Uintptr uintptr
+	Float32 float32
+	Float64 float64
+
+	Foo  string `json:"bar"`
+	Foo2 string `json:"bar2,dummyopt"`
+
+	IntStr int64 `json:",string"`
+
+	PBool    *bool
+	PInt     *int
+	PInt8    *int8
+	PInt16   *int16
+	PInt32   *int32
+	PInt64   *int64
+	PUint    *uint
+	PUint8   *uint8
+	PUint16  *uint16
+	PUint32  *uint32
+	PUint64  *uint64
+	PUintptr *uintptr
+	PFloat32 *float32
+	PFloat64 *float64
+
+	String  string
+	PString *string
+
+	Map   map[string]Small
+	MapP  map[string]*Small
+	PMap  *map[string]Small
+	PMapP *map[string]*Small
+
+	EmptyMap map[string]Small
+	NilMap   map[string]Small
+
+	Slice   []Small
+	SliceP  []*Small
+	PSlice  *[]Small
+	PSliceP *[]*Small
+
+	EmptySlice []Small
+	NilSlice   []Small
+
+	StringSlice []string
+	ByteSlice   []byte
+
+	Small   Small
+	PSmall  *Small
+	PPSmall **Small
+
+	Interface  interface{}
+	PInterface *interface{}
+
+	unexported int
+}
+
+type Small struct {
+	Tag string
+}
+
+var allValue = All{
+	Bool:    true,
+	Int:     2,
+	Int8:    3,
+	Int16:   4,
+	Int32:   5,
+	Int64:   6,
+	Uint:    7,
+	Uint8:   8,
+	Uint16:  9,
+	Uint32:  10,
+	Uint64:  11,
+	Uintptr: 12,
+	Float32: 14.1,
+	Float64: 15.1,
+	Foo:     "foo",
+	Foo2:    "foo2",
+	IntStr:  42,
+	String:  "16",
+	Map: map[string]Small{
+		"17": {Tag: "tag17"},
+		"18": {Tag: "tag18"},
+	},
+	MapP: map[string]*Small{
+		"19": {Tag: "tag19"},
+		"20": nil,
+	},
+	EmptyMap:    map[string]Small{},
+	Slice:       []Small{{Tag: "tag20"}, {Tag: "tag21"}},
+	SliceP:      []*Small{{Tag: "tag22"}, nil, {Tag: "tag23"}},
+	EmptySlice:  []Small{},
+	StringSlice: []string{"str24", "str25", "str26"},
+	ByteSlice:   []byte{27, 28, 29},
+	Small:       Small{Tag: "tag30"},
+	PSmall:      &Small{Tag: "tag31"},
+	Interface:   5.2,
+}
+
+var pallValue = All{
+	PBool:      &allValue.Bool,
+	PInt:       &allValue.Int,
+	PInt8:      &allValue.Int8,
+	PInt16:     &allValue.Int16,
+	PInt32:     &allValue.Int32,
+	PInt64:     &allValue.Int64,
+	PUint:      &allValue.Uint,
+	PUint8:     &allValue.Uint8,
+	PUint16:    &allValue.Uint16,
+	PUint32:    &allValue.Uint32,
+	PUint64:    &allValue.Uint64,
+	PUintptr:   &allValue.Uintptr,
+	PFloat32:   &allValue.Float32,
+	PFloat64:   &allValue.Float64,
+	PString:    &allValue.String,
+	PMap:       &allValue.Map,
+	PMapP:      &allValue.MapP,
+	PSlice:     &allValue.Slice,
+	PSliceP:    &allValue.SliceP,
+	PPSmall:    &allValue.PSmall,
+	PInterface: &allValue.Interface,
+}
+
+var allValueIndent = `{
+	"Bool": true,
+	"Int": 2,
+	"Int8": 3,
+	"Int16": 4,
+	"Int32": 5,
+	"Int64": 6,
+	"Uint": 7,
+	"Uint8": 8,
+	"Uint16": 9,
+	"Uint32": 10,
+	"Uint64": 11,
+	"Uintptr": 12,
+	"Float32": 14.1,
+	"Float64": 15.1,
+	"bar": "foo",
+	"bar2": "foo2",
+	"IntStr": "42",
+	"PBool": null,
+	"PInt": null,
+	"PInt8": null,
+	"PInt16": null,
+	"PInt32": null,
+	"PInt64": null,
+	"PUint": null,
+	"PUint8": null,
+	"PUint16": null,
+	"PUint32": null,
+	"PUint64": null,
+	"PUintptr": null,
+	"PFloat32": null,
+	"PFloat64": null,
+	"String": "16",
+	"PString": null,
+	"Map": {
+		"17": {
+			"Tag": "tag17"
+		},
+		"18": {
+			"Tag": "tag18"
+		}
+	},
+	"MapP": {
+		"19": {
+			"Tag": "tag19"
+		},
+		"20": null
+	},
+	"PMap": null,
+	"PMapP": null,
+	"EmptyMap": {},
+	"NilMap": null,
+	"Slice": [
+		{
+			"Tag": "tag20"
+		},
+		{
+			"Tag": "tag21"
+		}
+	],
+	"SliceP": [
+		{
+			"Tag": "tag22"
+		},
+		null,
+		{
+			"Tag": "tag23"
+		}
+	],
+	"PSlice": null,
+	"PSliceP": null,
+	"EmptySlice": [],
+	"NilSlice": null,
+	"StringSlice": [
+		"str24",
+		"str25",
+		"str26"
+	],
+	"ByteSlice": "Gxwd",
+	"Small": {
+		"Tag": "tag30"
+	},
+	"PSmall": {
+		"Tag": "tag31"
+	},
+	"PPSmall": null,
+	"Interface": 5.2,
+	"PInterface": null
+}`
+
+var allValueCompact = strings.Map(noSpace, allValueIndent)
+
+var pallValueIndent = `{
+	"Bool": false,
+	"Int": 0,
+	"Int8": 0,
+	"Int16": 0,
+	"Int32": 0,
+	"Int64": 0,
+	"Uint": 0,
+	"Uint8": 0,
+	"Uint16": 0,
+	"Uint32": 0,
+	"Uint64": 0,
+	"Uintptr": 0,
+	"Float32": 0,
+	"Float64": 0,
+	"bar": "",
+	"bar2": "",
+        "IntStr": "0",
+	"PBool": true,
+	"PInt": 2,
+	"PInt8": 3,
+	"PInt16": 4,
+	"PInt32": 5,
+	"PInt64": 6,
+	"PUint": 7,
+	"PUint8": 8,
+	"PUint16": 9,
+	"PUint32": 10,
+	"PUint64": 11,
+	"PUintptr": 12,
+	"PFloat32": 14.1,
+	"PFloat64": 15.1,
+	"String": "",
+	"PString": "16",
+	"Map": null,
+	"MapP": null,
+	"PMap": {
+		"17": {
+			"Tag": "tag17"
+		},
+		"18": {
+			"Tag": "tag18"
+		}
+	},
+	"PMapP": {
+		"19": {
+			"Tag": "tag19"
+		},
+		"20": null
+	},
+	"EmptyMap": null,
+	"NilMap": null,
+	"Slice": null,
+	"SliceP": null,
+	"PSlice": [
+		{
+			"Tag": "tag20"
+		},
+		{
+			"Tag": "tag21"
+		}
+	],
+	"PSliceP": [
+		{
+			"Tag": "tag22"
+		},
+		null,
+		{
+			"Tag": "tag23"
+		}
+	],
+	"EmptySlice": null,
+	"NilSlice": null,
+	"StringSlice": null,
+	"ByteSlice": null,
+	"Small": {
+		"Tag": ""
+	},
+	"PSmall": null,
+	"PPSmall": {
+		"Tag": "tag31"
+	},
+	"Interface": null,
+	"PInterface": 5.2
+}`
+
+var pallValueCompact = strings.Map(noSpace, pallValueIndent)
+
+func TestRefUnmarshal(t *testing.T) {
+	type S struct {
+		// Ref is defined in encode_test.go.
+		R0 Ref
+		R1 *Ref
+		R2 RefText
+		R3 *RefText
+	}
+	want := S{
+		R0: 12,
+		R1: new(Ref),
+		R2: 13,
+		R3: new(RefText),
+	}
+	*want.R1 = 12
+	*want.R3 = 13
+
+	var got S
+	if err := Unmarshal([]byte(`{"R0":"ref","R1":"ref","R2":"ref","R3":"ref"}`), &got); err != nil {
+		t.Fatalf("Unmarshal: %v", err)
+	}
+	if !reflect.DeepEqual(got, want) {
+		t.Errorf("got %+v, want %+v", got, want)
+	}
+}
+
+// Test that the empty string doesn't panic decoding when ,string is specified
+// Issue 3450
+func TestEmptyString(t *testing.T) {
+	type T2 struct {
+		Number1 int `json:",string"`
+		Number2 int `json:",string"`
+	}
+	data := `{"Number1":"1", "Number2":""}`
+	dec := NewDecoder(strings.NewReader(data))
+	var t2 T2
+	err := dec.Decode(&t2)
+	if err == nil {
+		t.Fatal("Decode: did not return error")
+	}
+	if t2.Number1 != 1 {
+		t.Fatal("Decode: did not set Number1")
+	}
+}
+
+// Test that a null for ,string is not replaced with the previous quoted string (issue 7046).
+// It should also not be an error (issue 2540, issue 8587).
+func TestNullString(t *testing.T) {
+	type T struct {
+		A int  `json:",string"`
+		B int  `json:",string"`
+		C *int `json:",string"`
+	}
+	data := []byte(`{"A": "1", "B": null, "C": null}`)
+	var s T
+	s.B = 1
+	s.C = new(int)
+	*s.C = 2
+	err := Unmarshal(data, &s)
+	if err != nil {
+		t.Fatalf("Unmarshal: %v", err)
+	}
+	if s.B != 1 || s.C != nil {
+		t.Fatalf("after Unmarshal, s.B=%d, s.C=%p, want 1, nil", s.B, s.C)
+	}
+}
+
+func intp(x int) *int {
+	p := new(int)
+	*p = x
+	return p
+}
+
+func intpp(x *int) **int {
+	pp := new(*int)
+	*pp = x
+	return pp
+}
+
+var interfaceSetTests = []struct {
+	pre  interface{}
+	json string
+	post interface{}
+}{
+	{"foo", `"bar"`, "bar"},
+	{"foo", `2`, 2.0},
+	{"foo", `true`, true},
+	{"foo", `null`, nil},
+
+	{nil, `null`, nil},
+	{new(int), `null`, nil},
+	{(*int)(nil), `null`, nil},
+	{new(*int), `null`, new(*int)},
+	{(**int)(nil), `null`, nil},
+	{intp(1), `null`, nil},
+	{intpp(nil), `null`, intpp(nil)},
+	{intpp(intp(1)), `null`, intpp(nil)},
+}
+
+func TestInterfaceSet(t *testing.T) {
+	for _, tt := range interfaceSetTests {
+		b := struct{ X interface{} }{tt.pre}
+		blob := `{"X":` + tt.json + `}`
+		if err := Unmarshal([]byte(blob), &b); err != nil {
+			t.Errorf("Unmarshal %#q: %v", blob, err)
+			continue
+		}
+		if !reflect.DeepEqual(b.X, tt.post) {
+			t.Errorf("Unmarshal %#q into %#v: X=%#v, want %#v", blob, tt.pre, b.X, tt.post)
+		}
+	}
+}
+
+// JSON null values should be ignored for primitives and string values instead of resulting in an error.
+// Issue 2540
+func TestUnmarshalNulls(t *testing.T) {
+	jsonData := []byte(`{
+		"Bool"    : null,
+		"Int"     : null,
+		"Int8"    : null,
+		"Int16"   : null,
+		"Int32"   : null,
+		"Int64"   : null,
+		"Uint"    : null,
+		"Uint8"   : null,
+		"Uint16"  : null,
+		"Uint32"  : null,
+		"Uint64"  : null,
+		"Float32" : null,
+		"Float64" : null,
+		"String"  : null}`)
+
+	nulls := All{
+		Bool:    true,
+		Int:     2,
+		Int8:    3,
+		Int16:   4,
+		Int32:   5,
+		Int64:   6,
+		Uint:    7,
+		Uint8:   8,
+		Uint16:  9,
+		Uint32:  10,
+		Uint64:  11,
+		Float32: 12.1,
+		Float64: 13.1,
+		String:  "14"}
+
+	err := Unmarshal(jsonData, &nulls)
+	if err != nil {
+		t.Errorf("Unmarshal of null values failed: %v", err)
+	}
+	if !nulls.Bool || nulls.Int != 2 || nulls.Int8 != 3 || nulls.Int16 != 4 || nulls.Int32 != 5 || nulls.Int64 != 6 ||
+		nulls.Uint != 7 || nulls.Uint8 != 8 || nulls.Uint16 != 9 || nulls.Uint32 != 10 || nulls.Uint64 != 11 ||
+		nulls.Float32 != 12.1 || nulls.Float64 != 13.1 || nulls.String != "14" {
+
+		t.Errorf("Unmarshal of null values affected primitives")
+	}
+}
+
+func TestStringKind(t *testing.T) {
+	type stringKind string
+
+	var m1, m2 map[stringKind]int
+	m1 = map[stringKind]int{
+		"foo": 42,
+	}
+
+	data, err := Marshal(m1)
+	if err != nil {
+		t.Errorf("Unexpected error marshaling: %v", err)
+	}
+
+	err = Unmarshal(data, &m2)
+	if err != nil {
+		t.Errorf("Unexpected error unmarshaling: %v", err)
+	}
+
+	if !reflect.DeepEqual(m1, m2) {
+		t.Error("Items should be equal after encoding and then decoding")
+	}
+}
+
+// Custom types with []byte as underlying type could not be marshalled
+// and then unmarshalled.
+// Issue 8962.
+func TestByteKind(t *testing.T) {
+	type byteKind []byte
+
+	a := byteKind("hello")
+
+	data, err := Marshal(a)
+	if err != nil {
+		t.Error(err)
+	}
+	var b byteKind
+	err = Unmarshal(data, &b)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(a, b) {
+		t.Errorf("expected %v == %v", a, b)
+	}
+}
+
+// The fix for issue 8962 introduced a regression.
+// Issue 12921.
+func TestSliceOfCustomByte(t *testing.T) {
+	type Uint8 uint8
+
+	a := []Uint8("hello")
+
+	data, err := Marshal(a)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var b []Uint8
+	err = Unmarshal(data, &b)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(a, b) {
+		t.Fatalf("expected %v == %v", a, b)
+	}
+}
+
+var decodeTypeErrorTests = []struct {
+	dest interface{}
+	src  string
+}{
+	{new(string), `{"user": "name"}`}, // issue 4628.
+	{new(error), `{}`},                // issue 4222
+	{new(error), `[]`},
+	{new(error), `""`},
+	{new(error), `123`},
+	{new(error), `true`},
+}
+
+func TestUnmarshalTypeError(t *testing.T) {
+	for _, item := range decodeTypeErrorTests {
+		err := Unmarshal([]byte(item.src), item.dest)
+		if _, ok := err.(*UnmarshalTypeError); !ok {
+			t.Errorf("expected type error for Unmarshal(%q, type %T): got %T",
+				item.src, item.dest, err)
+		}
+	}
+}
+
+var unmarshalSyntaxTests = []string{
+	"tru",
+	"fals",
+	"nul",
+	"123e",
+	`"hello`,
+	`[1,2,3`,
+	`{"key":1`,
+	`{"key":1,`,
+}
+
+func TestUnmarshalSyntax(t *testing.T) {
+	var x interface{}
+	for _, src := range unmarshalSyntaxTests {
+		err := Unmarshal([]byte(src), &x)
+		if _, ok := err.(*SyntaxError); !ok {
+			t.Errorf("expected syntax error for Unmarshal(%q): got %T", src, err)
+		}
+	}
+}
+
+// Test handling of unexported fields that should be ignored.
+// Issue 4660
+type unexportedFields struct {
+	Name string
+	m    map[string]interface{} `json:"-"`
+	m2   map[string]interface{} `json:"abcd"`
+}
+
+func TestUnmarshalUnexported(t *testing.T) {
+	input := `{"Name": "Bob", "m": {"x": 123}, "m2": {"y": 456}, "abcd": {"z": 789}}`
+	want := &unexportedFields{Name: "Bob"}
+
+	out := &unexportedFields{}
+	err := Unmarshal([]byte(input), out)
+	if err != nil {
+		t.Errorf("got error %v, expected nil", err)
+	}
+	if !reflect.DeepEqual(out, want) {
+		t.Errorf("got %q, want %q", out, want)
+	}
+}
+
+// Time3339 is a time.Time which encodes to and from JSON
+// as an RFC 3339 time in UTC.
+type Time3339 time.Time
+
+func (t *Time3339) UnmarshalJSON(b []byte) error {
+	if len(b) < 2 || b[0] != '"' || b[len(b)-1] != '"' {
+		return fmt.Errorf("types: failed to unmarshal non-string value %q as an RFC 3339 time", b)
+	}
+	tm, err := time.Parse(time.RFC3339, string(b[1:len(b)-1]))
+	if err != nil {
+		return err
+	}
+	*t = Time3339(tm)
+	return nil
+}
+
+func TestUnmarshalJSONLiteralError(t *testing.T) {
+	var t3 Time3339
+	err := Unmarshal([]byte(`"0000-00-00T00:00:00Z"`), &t3)
+	if err == nil {
+		t.Fatalf("expected error; got time %v", time.Time(t3))
+	}
+	if !strings.Contains(err.Error(), "range") {
+		t.Errorf("got err = %v; want out of range error", err)
+	}
+}
+
+// Test that extra object elements in an array do not result in a
+// "data changing underfoot" error.
+// Issue 3717
+func TestSkipArrayObjects(t *testing.T) {
+	json := `[{}]`
+	var dest [0]interface{}
+
+	err := Unmarshal([]byte(json), &dest)
+	if err != nil {
+		t.Errorf("got error %q, want nil", err)
+	}
+}
+
+// Test semantics of pre-filled struct fields and pre-filled map fields.
+// Issue 4900.
+func TestPrefilled(t *testing.T) {
+	ptrToMap := func(m map[string]interface{}) *map[string]interface{} { return &m }
+
+	// Values here change, cannot reuse table across runs.
+	var prefillTests = []struct {
+		in  string
+		ptr interface{}
+		out interface{}
+	}{
+		{
+			in:  `{"X": 1, "Y": 2}`,
+			ptr: &XYZ{X: float32(3), Y: int16(4), Z: 1.5},
+			out: &XYZ{X: float64(1), Y: float64(2), Z: 1.5},
+		},
+		{
+			in:  `{"X": 1, "Y": 2}`,
+			ptr: ptrToMap(map[string]interface{}{"X": float32(3), "Y": int16(4), "Z": 1.5}),
+			out: ptrToMap(map[string]interface{}{"X": float64(1), "Y": float64(2), "Z": 1.5}),
+		},
+	}
+
+	for _, tt := range prefillTests {
+		ptrstr := fmt.Sprintf("%v", tt.ptr)
+		err := Unmarshal([]byte(tt.in), tt.ptr) // tt.ptr edited here
+		if err != nil {
+			t.Errorf("Unmarshal: %v", err)
+		}
+		if !reflect.DeepEqual(tt.ptr, tt.out) {
+			t.Errorf("Unmarshal(%#q, %s): have %v, want %v", tt.in, ptrstr, tt.ptr, tt.out)
+		}
+	}
+}
+
+var invalidUnmarshalTests = []struct {
+	v    interface{}
+	want string
+}{
+	{nil, "json: Unmarshal(nil)"},
+	{struct{}{}, "json: Unmarshal(non-pointer struct {})"},
+	{(*int)(nil), "json: Unmarshal(nil *int)"},
+}
+
+func TestInvalidUnmarshal(t *testing.T) {
+	buf := []byte(`{"a":"1"}`)
+	for _, tt := range invalidUnmarshalTests {
+		err := Unmarshal(buf, tt.v)
+		if err == nil {
+			t.Errorf("Unmarshal expecting error, got nil")
+			continue
+		}
+		if got := err.Error(); got != tt.want {
+			t.Errorf("Unmarshal = %q; want %q", got, tt.want)
+		}
+	}
+}
+
+var invalidUnmarshalTextTests = []struct {
+	v    interface{}
+	want string
+}{
+	{nil, "json: Unmarshal(nil)"},
+	{struct{}{}, "json: Unmarshal(non-pointer struct {})"},
+	{(*int)(nil), "json: Unmarshal(nil *int)"},
+	{new(net.IP), "json: cannot unmarshal string into Go value of type *net.IP"},
+}
+
+func TestInvalidUnmarshalText(t *testing.T) {
+	buf := []byte(`123`)
+	for _, tt := range invalidUnmarshalTextTests {
+		err := Unmarshal(buf, tt.v)
+		if err == nil {
+			t.Errorf("Unmarshal expecting error, got nil")
+			continue
+		}
+		if got := err.Error(); got != tt.want {
+			t.Errorf("Unmarshal = %q; want %q", got, tt.want)
+		}
+	}
+}
+
+// Test that string option is ignored for invalid types.
+// Issue 9812.
+func TestInvalidStringOption(t *testing.T) {
+	num := 0
+	item := struct {
+		T time.Time         `json:",string"`
+		M map[string]string `json:",string"`
+		S []string          `json:",string"`
+		A [1]string         `json:",string"`
+		I interface{}       `json:",string"`
+		P *int              `json:",string"`
+	}{M: make(map[string]string), S: make([]string, 0), I: num, P: &num}
+
+	data, err := Marshal(item)
+	if err != nil {
+		t.Fatalf("Marshal: %v", err)
+	}
+
+	err = Unmarshal(data, &item)
+	if err != nil {
+		t.Fatalf("Unmarshal: %v", err)
+	}
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/json/encode.go b/vendor/gopkg.in/square/go-jose.v2/json/encode.go
new file mode 100644
index 0000000..1dae8bb
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/json/encode.go
@@ -0,0 +1,1197 @@
+// Copyright 2010 The Go Authors.  All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package json implements encoding and decoding of JSON objects as defined in
+// RFC 4627. The mapping between JSON objects and Go values is described
+// in the documentation for the Marshal and Unmarshal functions.
+//
+// See "JSON and Go" for an introduction to this package:
+// https://golang.org/doc/articles/json_and_go.html
+package json
+
+import (
+	"bytes"
+	"encoding"
+	"encoding/base64"
+	"fmt"
+	"math"
+	"reflect"
+	"runtime"
+	"sort"
+	"strconv"
+	"strings"
+	"sync"
+	"unicode"
+	"unicode/utf8"
+)
+
+// Marshal returns the JSON encoding of v.
+//
+// Marshal traverses the value v recursively.
+// If an encountered value implements the Marshaler interface
+// and is not a nil pointer, Marshal calls its MarshalJSON method
+// to produce JSON. If no MarshalJSON method is present but the
+// value implements encoding.TextMarshaler instead, Marshal calls
+// its MarshalText method.
+// The nil pointer exception is not strictly necessary
+// but mimics a similar, necessary exception in the behavior of
+// UnmarshalJSON.
+//
+// Otherwise, Marshal uses the following type-dependent default encodings:
+//
+// Boolean values encode as JSON booleans.
+//
+// Floating point, integer, and Number values encode as JSON numbers.
+//
+// String values encode as JSON strings coerced to valid UTF-8,
+// replacing invalid bytes with the Unicode replacement rune.
+// The angle brackets "<" and ">" are escaped to "\u003c" and "\u003e"
+// to keep some browsers from misinterpreting JSON output as HTML.
+// Ampersand "&" is also escaped to "\u0026" for the same reason.
+//
+// Array and slice values encode as JSON arrays, except that
+// []byte encodes as a base64-encoded string, and a nil slice
+// encodes as the null JSON object.
+//
+// Struct values encode as JSON objects. Each exported struct field
+// becomes a member of the object unless
+//   - the field's tag is "-", or
+//   - the field is empty and its tag specifies the "omitempty" option.
+// The empty values are false, 0, any
+// nil pointer or interface value, and any array, slice, map, or string of
+// length zero. The object's default key string is the struct field name
+// but can be specified in the struct field's tag value. The "json" key in
+// the struct field's tag value is the key name, followed by an optional comma
+// and options. Examples:
+//
+//   // Field is ignored by this package.
+//   Field int `json:"-"`
+//
+//   // Field appears in JSON as key "myName".
+//   Field int `json:"myName"`
+//
+//   // Field appears in JSON as key "myName" and
+//   // the field is omitted from the object if its value is empty,
+//   // as defined above.
+//   Field int `json:"myName,omitempty"`
+//
+//   // Field appears in JSON as key "Field" (the default), but
+//   // the field is skipped if empty.
+//   // Note the leading comma.
+//   Field int `json:",omitempty"`
+//
+// The "string" option signals that a field is stored as JSON inside a
+// JSON-encoded string. It applies only to fields of string, floating point,
+// integer, or boolean types. This extra level of encoding is sometimes used
+// when communicating with JavaScript programs:
+//
+//    Int64String int64 `json:",string"`
+//
+// The key name will be used if it's a non-empty string consisting of
+// only Unicode letters, digits, dollar signs, percent signs, hyphens,
+// underscores and slashes.
+//
+// Anonymous struct fields are usually marshaled as if their inner exported fields
+// were fields in the outer struct, subject to the usual Go visibility rules amended
+// as described in the next paragraph.
+// An anonymous struct field with a name given in its JSON tag is treated as
+// having that name, rather than being anonymous.
+// An anonymous struct field of interface type is treated the same as having
+// that type as its name, rather than being anonymous.
+//
+// The Go visibility rules for struct fields are amended for JSON when
+// deciding which field to marshal or unmarshal. If there are
+// multiple fields at the same level, and that level is the least
+// nested (and would therefore be the nesting level selected by the
+// usual Go rules), the following extra rules apply:
+//
+// 1) Of those fields, if any are JSON-tagged, only tagged fields are considered,
+// even if there are multiple untagged fields that would otherwise conflict.
+// 2) If there is exactly one field (tagged or not according to the first rule), that is selected.
+// 3) Otherwise there are multiple fields, and all are ignored; no error occurs.
+//
+// Handling of anonymous struct fields is new in Go 1.1.
+// Prior to Go 1.1, anonymous struct fields were ignored. To force ignoring of
+// an anonymous struct field in both current and earlier versions, give the field
+// a JSON tag of "-".
+//
+// Map values encode as JSON objects.
+// The map's key type must be string; the map keys are used as JSON object
+// keys, subject to the UTF-8 coercion described for string values above.
+//
+// Pointer values encode as the value pointed to.
+// A nil pointer encodes as the null JSON object.
+//
+// Interface values encode as the value contained in the interface.
+// A nil interface value encodes as the null JSON object.
+//
+// Channel, complex, and function values cannot be encoded in JSON.
+// Attempting to encode such a value causes Marshal to return
+// an UnsupportedTypeError.
+//
+// JSON cannot represent cyclic data structures and Marshal does not
+// handle them.  Passing cyclic structures to Marshal will result in
+// an infinite recursion.
+//
+func Marshal(v interface{}) ([]byte, error) {
+	e := &encodeState{}
+	err := e.marshal(v)
+	if err != nil {
+		return nil, err
+	}
+	return e.Bytes(), nil
+}
+
+// MarshalIndent is like Marshal but applies Indent to format the output.
+func MarshalIndent(v interface{}, prefix, indent string) ([]byte, error) {
+	b, err := Marshal(v)
+	if err != nil {
+		return nil, err
+	}
+	var buf bytes.Buffer
+	err = Indent(&buf, b, prefix, indent)
+	if err != nil {
+		return nil, err
+	}
+	return buf.Bytes(), nil
+}
+
+// HTMLEscape appends to dst the JSON-encoded src with <, >, &, U+2028 and U+2029
+// characters inside string literals changed to \u003c, \u003e, \u0026, \u2028, \u2029
+// so that the JSON will be safe to embed inside HTML <script> tags.
+// For historical reasons, web browsers don't honor standard HTML
+// escaping within <script> tags, so an alternative JSON encoding must
+// be used.
+func HTMLEscape(dst *bytes.Buffer, src []byte) {
+	// The characters can only appear in string literals,
+	// so just scan the string one byte at a time.
+	start := 0
+	for i, c := range src {
+		if c == '<' || c == '>' || c == '&' {
+			if start < i {
+				dst.Write(src[start:i])
+			}
+			dst.WriteString(`\u00`)
+			dst.WriteByte(hex[c>>4])
+			dst.WriteByte(hex[c&0xF])
+			start = i + 1
+		}
+		// Convert U+2028 and U+2029 (E2 80 A8 and E2 80 A9).
+		if c == 0xE2 && i+2 < len(src) && src[i+1] == 0x80 && src[i+2]&^1 == 0xA8 {
+			if start < i {
+				dst.Write(src[start:i])
+			}
+			dst.WriteString(`\u202`)
+			dst.WriteByte(hex[src[i+2]&0xF])
+			start = i + 3
+		}
+	}
+	if start < len(src) {
+		dst.Write(src[start:])
+	}
+}
+
+// Marshaler is the interface implemented by objects that
+// can marshal themselves into valid JSON.
+type Marshaler interface {
+	MarshalJSON() ([]byte, error)
+}
+
+// An UnsupportedTypeError is returned by Marshal when attempting
+// to encode an unsupported value type.
+type UnsupportedTypeError struct {
+	Type reflect.Type
+}
+
+func (e *UnsupportedTypeError) Error() string {
+	return "json: unsupported type: " + e.Type.String()
+}
+
+type UnsupportedValueError struct {
+	Value reflect.Value
+	Str   string
+}
+
+func (e *UnsupportedValueError) Error() string {
+	return "json: unsupported value: " + e.Str
+}
+
+// Before Go 1.2, an InvalidUTF8Error was returned by Marshal when
+// attempting to encode a string value with invalid UTF-8 sequences.
+// As of Go 1.2, Marshal instead coerces the string to valid UTF-8 by
+// replacing invalid bytes with the Unicode replacement rune U+FFFD.
+// This error is no longer generated but is kept for backwards compatibility
+// with programs that might mention it.
+type InvalidUTF8Error struct {
+	S string // the whole string value that caused the error
+}
+
+func (e *InvalidUTF8Error) Error() string {
+	return "json: invalid UTF-8 in string: " + strconv.Quote(e.S)
+}
+
+type MarshalerError struct {
+	Type reflect.Type
+	Err  error
+}
+
+func (e *MarshalerError) Error() string {
+	return "json: error calling MarshalJSON for type " + e.Type.String() + ": " + e.Err.Error()
+}
+
+var hex = "0123456789abcdef"
+
+// An encodeState encodes JSON into a bytes.Buffer.
+type encodeState struct {
+	bytes.Buffer // accumulated output
+	scratch      [64]byte
+}
+
+var encodeStatePool sync.Pool
+
+func newEncodeState() *encodeState {
+	if v := encodeStatePool.Get(); v != nil {
+		e := v.(*encodeState)
+		e.Reset()
+		return e
+	}
+	return new(encodeState)
+}
+
+func (e *encodeState) marshal(v interface{}) (err error) {
+	defer func() {
+		if r := recover(); r != nil {
+			if _, ok := r.(runtime.Error); ok {
+				panic(r)
+			}
+			if s, ok := r.(string); ok {
+				panic(s)
+			}
+			err = r.(error)
+		}
+	}()
+	e.reflectValue(reflect.ValueOf(v))
+	return nil
+}
+
+func (e *encodeState) error(err error) {
+	panic(err)
+}
+
+func isEmptyValue(v reflect.Value) bool {
+	switch v.Kind() {
+	case reflect.Array, reflect.Map, reflect.Slice, reflect.String:
+		return v.Len() == 0
+	case reflect.Bool:
+		return !v.Bool()
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		return v.Int() == 0
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
+		return v.Uint() == 0
+	case reflect.Float32, reflect.Float64:
+		return v.Float() == 0
+	case reflect.Interface, reflect.Ptr:
+		return v.IsNil()
+	}
+	return false
+}
+
+func (e *encodeState) reflectValue(v reflect.Value) {
+	valueEncoder(v)(e, v, false)
+}
+
+type encoderFunc func(e *encodeState, v reflect.Value, quoted bool)
+
+var encoderCache struct {
+	sync.RWMutex
+	m map[reflect.Type]encoderFunc
+}
+
+func valueEncoder(v reflect.Value) encoderFunc {
+	if !v.IsValid() {
+		return invalidValueEncoder
+	}
+	return typeEncoder(v.Type())
+}
+
+func typeEncoder(t reflect.Type) encoderFunc {
+	encoderCache.RLock()
+	f := encoderCache.m[t]
+	encoderCache.RUnlock()
+	if f != nil {
+		return f
+	}
+
+	// To deal with recursive types, populate the map with an
+	// indirect func before we build it. This type waits on the
+	// real func (f) to be ready and then calls it.  This indirect
+	// func is only used for recursive types.
+	encoderCache.Lock()
+	if encoderCache.m == nil {
+		encoderCache.m = make(map[reflect.Type]encoderFunc)
+	}
+	var wg sync.WaitGroup
+	wg.Add(1)
+	encoderCache.m[t] = func(e *encodeState, v reflect.Value, quoted bool) {
+		wg.Wait()
+		f(e, v, quoted)
+	}
+	encoderCache.Unlock()
+
+	// Compute fields without lock.
+	// Might duplicate effort but won't hold other computations back.
+	f = newTypeEncoder(t, true)
+	wg.Done()
+	encoderCache.Lock()
+	encoderCache.m[t] = f
+	encoderCache.Unlock()
+	return f
+}
+
+var (
+	marshalerType     = reflect.TypeOf(new(Marshaler)).Elem()
+	textMarshalerType = reflect.TypeOf(new(encoding.TextMarshaler)).Elem()
+)
+
+// newTypeEncoder constructs an encoderFunc for a type.
+// The returned encoder only checks CanAddr when allowAddr is true.
+func newTypeEncoder(t reflect.Type, allowAddr bool) encoderFunc {
+	if t.Implements(marshalerType) {
+		return marshalerEncoder
+	}
+	if t.Kind() != reflect.Ptr && allowAddr {
+		if reflect.PtrTo(t).Implements(marshalerType) {
+			return newCondAddrEncoder(addrMarshalerEncoder, newTypeEncoder(t, false))
+		}
+	}
+
+	if t.Implements(textMarshalerType) {
+		return textMarshalerEncoder
+	}
+	if t.Kind() != reflect.Ptr && allowAddr {
+		if reflect.PtrTo(t).Implements(textMarshalerType) {
+			return newCondAddrEncoder(addrTextMarshalerEncoder, newTypeEncoder(t, false))
+		}
+	}
+
+	switch t.Kind() {
+	case reflect.Bool:
+		return boolEncoder
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		return intEncoder
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
+		return uintEncoder
+	case reflect.Float32:
+		return float32Encoder
+	case reflect.Float64:
+		return float64Encoder
+	case reflect.String:
+		return stringEncoder
+	case reflect.Interface:
+		return interfaceEncoder
+	case reflect.Struct:
+		return newStructEncoder(t)
+	case reflect.Map:
+		return newMapEncoder(t)
+	case reflect.Slice:
+		return newSliceEncoder(t)
+	case reflect.Array:
+		return newArrayEncoder(t)
+	case reflect.Ptr:
+		return newPtrEncoder(t)
+	default:
+		return unsupportedTypeEncoder
+	}
+}
+
+func invalidValueEncoder(e *encodeState, v reflect.Value, quoted bool) {
+	e.WriteString("null")
+}
+
+func marshalerEncoder(e *encodeState, v reflect.Value, quoted bool) {
+	if v.Kind() == reflect.Ptr && v.IsNil() {
+		e.WriteString("null")
+		return
+	}
+	m := v.Interface().(Marshaler)
+	b, err := m.MarshalJSON()
+	if err == nil {
+		// copy JSON into buffer, checking validity.
+		err = compact(&e.Buffer, b, true)
+	}
+	if err != nil {
+		e.error(&MarshalerError{v.Type(), err})
+	}
+}
+
+func addrMarshalerEncoder(e *encodeState, v reflect.Value, quoted bool) {
+	va := v.Addr()
+	if va.IsNil() {
+		e.WriteString("null")
+		return
+	}
+	m := va.Interface().(Marshaler)
+	b, err := m.MarshalJSON()
+	if err == nil {
+		// copy JSON into buffer, checking validity.
+		err = compact(&e.Buffer, b, true)
+	}
+	if err != nil {
+		e.error(&MarshalerError{v.Type(), err})
+	}
+}
+
+func textMarshalerEncoder(e *encodeState, v reflect.Value, quoted bool) {
+	if v.Kind() == reflect.Ptr && v.IsNil() {
+		e.WriteString("null")
+		return
+	}
+	m := v.Interface().(encoding.TextMarshaler)
+	b, err := m.MarshalText()
+	if err != nil {
+		e.error(&MarshalerError{v.Type(), err})
+	}
+	e.stringBytes(b)
+}
+
+func addrTextMarshalerEncoder(e *encodeState, v reflect.Value, quoted bool) {
+	va := v.Addr()
+	if va.IsNil() {
+		e.WriteString("null")
+		return
+	}
+	m := va.Interface().(encoding.TextMarshaler)
+	b, err := m.MarshalText()
+	if err != nil {
+		e.error(&MarshalerError{v.Type(), err})
+	}
+	e.stringBytes(b)
+}
+
+func boolEncoder(e *encodeState, v reflect.Value, quoted bool) {
+	if quoted {
+		e.WriteByte('"')
+	}
+	if v.Bool() {
+		e.WriteString("true")
+	} else {
+		e.WriteString("false")
+	}
+	if quoted {
+		e.WriteByte('"')
+	}
+}
+
+func intEncoder(e *encodeState, v reflect.Value, quoted bool) {
+	b := strconv.AppendInt(e.scratch[:0], v.Int(), 10)
+	if quoted {
+		e.WriteByte('"')
+	}
+	e.Write(b)
+	if quoted {
+		e.WriteByte('"')
+	}
+}
+
+func uintEncoder(e *encodeState, v reflect.Value, quoted bool) {
+	b := strconv.AppendUint(e.scratch[:0], v.Uint(), 10)
+	if quoted {
+		e.WriteByte('"')
+	}
+	e.Write(b)
+	if quoted {
+		e.WriteByte('"')
+	}
+}
+
+type floatEncoder int // number of bits
+
+func (bits floatEncoder) encode(e *encodeState, v reflect.Value, quoted bool) {
+	f := v.Float()
+	if math.IsInf(f, 0) || math.IsNaN(f) {
+		e.error(&UnsupportedValueError{v, strconv.FormatFloat(f, 'g', -1, int(bits))})
+	}
+	b := strconv.AppendFloat(e.scratch[:0], f, 'g', -1, int(bits))
+	if quoted {
+		e.WriteByte('"')
+	}
+	e.Write(b)
+	if quoted {
+		e.WriteByte('"')
+	}
+}
+
+var (
+	float32Encoder = (floatEncoder(32)).encode
+	float64Encoder = (floatEncoder(64)).encode
+)
+
+func stringEncoder(e *encodeState, v reflect.Value, quoted bool) {
+	if v.Type() == numberType {
+		numStr := v.String()
+		// In Go1.5 the empty string encodes to "0", while this is not a valid number literal
+		// we keep compatibility so check validity after this.
+		if numStr == "" {
+			numStr = "0" // Number's zero-val
+		}
+		if !isValidNumber(numStr) {
+			e.error(fmt.Errorf("json: invalid number literal %q", numStr))
+		}
+		e.WriteString(numStr)
+		return
+	}
+	if quoted {
+		sb, err := Marshal(v.String())
+		if err != nil {
+			e.error(err)
+		}
+		e.string(string(sb))
+	} else {
+		e.string(v.String())
+	}
+}
+
+func interfaceEncoder(e *encodeState, v reflect.Value, quoted bool) {
+	if v.IsNil() {
+		e.WriteString("null")
+		return
+	}
+	e.reflectValue(v.Elem())
+}
+
+func unsupportedTypeEncoder(e *encodeState, v reflect.Value, quoted bool) {
+	e.error(&UnsupportedTypeError{v.Type()})
+}
+
+type structEncoder struct {
+	fields    []field
+	fieldEncs []encoderFunc
+}
+
+func (se *structEncoder) encode(e *encodeState, v reflect.Value, quoted bool) {
+	e.WriteByte('{')
+	first := true
+	for i, f := range se.fields {
+		fv := fieldByIndex(v, f.index)
+		if !fv.IsValid() || f.omitEmpty && isEmptyValue(fv) {
+			continue
+		}
+		if first {
+			first = false
+		} else {
+			e.WriteByte(',')
+		}
+		e.string(f.name)
+		e.WriteByte(':')
+		se.fieldEncs[i](e, fv, f.quoted)
+	}
+	e.WriteByte('}')
+}
+
+func newStructEncoder(t reflect.Type) encoderFunc {
+	fields := cachedTypeFields(t)
+	se := &structEncoder{
+		fields:    fields,
+		fieldEncs: make([]encoderFunc, len(fields)),
+	}
+	for i, f := range fields {
+		se.fieldEncs[i] = typeEncoder(typeByIndex(t, f.index))
+	}
+	return se.encode
+}
+
+type mapEncoder struct {
+	elemEnc encoderFunc
+}
+
+func (me *mapEncoder) encode(e *encodeState, v reflect.Value, _ bool) {
+	if v.IsNil() {
+		e.WriteString("null")
+		return
+	}
+	e.WriteByte('{')
+	var sv stringValues = v.MapKeys()
+	sort.Sort(sv)
+	for i, k := range sv {
+		if i > 0 {
+			e.WriteByte(',')
+		}
+		e.string(k.String())
+		e.WriteByte(':')
+		me.elemEnc(e, v.MapIndex(k), false)
+	}
+	e.WriteByte('}')
+}
+
+func newMapEncoder(t reflect.Type) encoderFunc {
+	if t.Key().Kind() != reflect.String {
+		return unsupportedTypeEncoder
+	}
+	me := &mapEncoder{typeEncoder(t.Elem())}
+	return me.encode
+}
+
+func encodeByteSlice(e *encodeState, v reflect.Value, _ bool) {
+	if v.IsNil() {
+		e.WriteString("null")
+		return
+	}
+	s := v.Bytes()
+	e.WriteByte('"')
+	if len(s) < 1024 {
+		// for small buffers, using Encode directly is much faster.
+		dst := make([]byte, base64.StdEncoding.EncodedLen(len(s)))
+		base64.StdEncoding.Encode(dst, s)
+		e.Write(dst)
+	} else {
+		// for large buffers, avoid unnecessary extra temporary
+		// buffer space.
+		enc := base64.NewEncoder(base64.StdEncoding, e)
+		enc.Write(s)
+		enc.Close()
+	}
+	e.WriteByte('"')
+}
+
+// sliceEncoder just wraps an arrayEncoder, checking to make sure the value isn't nil.
+type sliceEncoder struct {
+	arrayEnc encoderFunc
+}
+
+func (se *sliceEncoder) encode(e *encodeState, v reflect.Value, _ bool) {
+	if v.IsNil() {
+		e.WriteString("null")
+		return
+	}
+	se.arrayEnc(e, v, false)
+}
+
+func newSliceEncoder(t reflect.Type) encoderFunc {
+	// Byte slices get special treatment; arrays don't.
+	if t.Elem().Kind() == reflect.Uint8 {
+		return encodeByteSlice
+	}
+	enc := &sliceEncoder{newArrayEncoder(t)}
+	return enc.encode
+}
+
+type arrayEncoder struct {
+	elemEnc encoderFunc
+}
+
+func (ae *arrayEncoder) encode(e *encodeState, v reflect.Value, _ bool) {
+	e.WriteByte('[')
+	n := v.Len()
+	for i := 0; i < n; i++ {
+		if i > 0 {
+			e.WriteByte(',')
+		}
+		ae.elemEnc(e, v.Index(i), false)
+	}
+	e.WriteByte(']')
+}
+
+func newArrayEncoder(t reflect.Type) encoderFunc {
+	enc := &arrayEncoder{typeEncoder(t.Elem())}
+	return enc.encode
+}
+
+type ptrEncoder struct {
+	elemEnc encoderFunc
+}
+
+func (pe *ptrEncoder) encode(e *encodeState, v reflect.Value, quoted bool) {
+	if v.IsNil() {
+		e.WriteString("null")
+		return
+	}
+	pe.elemEnc(e, v.Elem(), quoted)
+}
+
+func newPtrEncoder(t reflect.Type) encoderFunc {
+	enc := &ptrEncoder{typeEncoder(t.Elem())}
+	return enc.encode
+}
+
+type condAddrEncoder struct {
+	canAddrEnc, elseEnc encoderFunc
+}
+
+func (ce *condAddrEncoder) encode(e *encodeState, v reflect.Value, quoted bool) {
+	if v.CanAddr() {
+		ce.canAddrEnc(e, v, quoted)
+	} else {
+		ce.elseEnc(e, v, quoted)
+	}
+}
+
+// newCondAddrEncoder returns an encoder that checks whether its value
+// CanAddr and delegates to canAddrEnc if so, else to elseEnc.
+func newCondAddrEncoder(canAddrEnc, elseEnc encoderFunc) encoderFunc {
+	enc := &condAddrEncoder{canAddrEnc: canAddrEnc, elseEnc: elseEnc}
+	return enc.encode
+}
+
+func isValidTag(s string) bool {
+	if s == "" {
+		return false
+	}
+	for _, c := range s {
+		switch {
+		case strings.ContainsRune("!#$%&()*+-./:<=>?@[]^_{|}~ ", c):
+			// Backslash and quote chars are reserved, but
+			// otherwise any punctuation chars are allowed
+			// in a tag name.
+		default:
+			if !unicode.IsLetter(c) && !unicode.IsDigit(c) {
+				return false
+			}
+		}
+	}
+	return true
+}
+
+func fieldByIndex(v reflect.Value, index []int) reflect.Value {
+	for _, i := range index {
+		if v.Kind() == reflect.Ptr {
+			if v.IsNil() {
+				return reflect.Value{}
+			}
+			v = v.Elem()
+		}
+		v = v.Field(i)
+	}
+	return v
+}
+
+func typeByIndex(t reflect.Type, index []int) reflect.Type {
+	for _, i := range index {
+		if t.Kind() == reflect.Ptr {
+			t = t.Elem()
+		}
+		t = t.Field(i).Type
+	}
+	return t
+}
+
+// stringValues is a slice of reflect.Value holding *reflect.StringValue.
+// It implements the methods to sort by string.
+type stringValues []reflect.Value
+
+func (sv stringValues) Len() int           { return len(sv) }
+func (sv stringValues) Swap(i, j int)      { sv[i], sv[j] = sv[j], sv[i] }
+func (sv stringValues) Less(i, j int) bool { return sv.get(i) < sv.get(j) }
+func (sv stringValues) get(i int) string   { return sv[i].String() }
+
+// NOTE: keep in sync with stringBytes below.
+func (e *encodeState) string(s string) int {
+	len0 := e.Len()
+	e.WriteByte('"')
+	start := 0
+	for i := 0; i < len(s); {
+		if b := s[i]; b < utf8.RuneSelf {
+			if 0x20 <= b && b != '\\' && b != '"' && b != '<' && b != '>' && b != '&' {
+				i++
+				continue
+			}
+			if start < i {
+				e.WriteString(s[start:i])
+			}
+			switch b {
+			case '\\', '"':
+				e.WriteByte('\\')
+				e.WriteByte(b)
+			case '\n':
+				e.WriteByte('\\')
+				e.WriteByte('n')
+			case '\r':
+				e.WriteByte('\\')
+				e.WriteByte('r')
+			case '\t':
+				e.WriteByte('\\')
+				e.WriteByte('t')
+			default:
+				// This encodes bytes < 0x20 except for \n and \r,
+				// as well as <, > and &. The latter are escaped because they
+				// can lead to security holes when user-controlled strings
+				// are rendered into JSON and served to some browsers.
+				e.WriteString(`\u00`)
+				e.WriteByte(hex[b>>4])
+				e.WriteByte(hex[b&0xF])
+			}
+			i++
+			start = i
+			continue
+		}
+		c, size := utf8.DecodeRuneInString(s[i:])
+		if c == utf8.RuneError && size == 1 {
+			if start < i {
+				e.WriteString(s[start:i])
+			}
+			e.WriteString(`\ufffd`)
+			i += size
+			start = i
+			continue
+		}
+		// U+2028 is LINE SEPARATOR.
+		// U+2029 is PARAGRAPH SEPARATOR.
+		// They are both technically valid characters in JSON strings,
+		// but don't work in JSONP, which has to be evaluated as JavaScript,
+		// and can lead to security holes there. It is valid JSON to
+		// escape them, so we do so unconditionally.
+		// See http://timelessrepo.com/json-isnt-a-javascript-subset for discussion.
+		if c == '\u2028' || c == '\u2029' {
+			if start < i {
+				e.WriteString(s[start:i])
+			}
+			e.WriteString(`\u202`)
+			e.WriteByte(hex[c&0xF])
+			i += size
+			start = i
+			continue
+		}
+		i += size
+	}
+	if start < len(s) {
+		e.WriteString(s[start:])
+	}
+	e.WriteByte('"')
+	return e.Len() - len0
+}
+
+// NOTE: keep in sync with string above.
+func (e *encodeState) stringBytes(s []byte) int {
+	len0 := e.Len()
+	e.WriteByte('"')
+	start := 0
+	for i := 0; i < len(s); {
+		if b := s[i]; b < utf8.RuneSelf {
+			if 0x20 <= b && b != '\\' && b != '"' && b != '<' && b != '>' && b != '&' {
+				i++
+				continue
+			}
+			if start < i {
+				e.Write(s[start:i])
+			}
+			switch b {
+			case '\\', '"':
+				e.WriteByte('\\')
+				e.WriteByte(b)
+			case '\n':
+				e.WriteByte('\\')
+				e.WriteByte('n')
+			case '\r':
+				e.WriteByte('\\')
+				e.WriteByte('r')
+			case '\t':
+				e.WriteByte('\\')
+				e.WriteByte('t')
+			default:
+				// This encodes bytes < 0x20 except for \n and \r,
+				// as well as <, >, and &. The latter are escaped because they
+				// can lead to security holes when user-controlled strings
+				// are rendered into JSON and served to some browsers.
+				e.WriteString(`\u00`)
+				e.WriteByte(hex[b>>4])
+				e.WriteByte(hex[b&0xF])
+			}
+			i++
+			start = i
+			continue
+		}
+		c, size := utf8.DecodeRune(s[i:])
+		if c == utf8.RuneError && size == 1 {
+			if start < i {
+				e.Write(s[start:i])
+			}
+			e.WriteString(`\ufffd`)
+			i += size
+			start = i
+			continue
+		}
+		// U+2028 is LINE SEPARATOR.
+		// U+2029 is PARAGRAPH SEPARATOR.
+		// They are both technically valid characters in JSON strings,
+		// but don't work in JSONP, which has to be evaluated as JavaScript,
+		// and can lead to security holes there. It is valid JSON to
+		// escape them, so we do so unconditionally.
+		// See http://timelessrepo.com/json-isnt-a-javascript-subset for discussion.
+		if c == '\u2028' || c == '\u2029' {
+			if start < i {
+				e.Write(s[start:i])
+			}
+			e.WriteString(`\u202`)
+			e.WriteByte(hex[c&0xF])
+			i += size
+			start = i
+			continue
+		}
+		i += size
+	}
+	if start < len(s) {
+		e.Write(s[start:])
+	}
+	e.WriteByte('"')
+	return e.Len() - len0
+}
+
+// A field represents a single field found in a struct.
+type field struct {
+	name      string
+	nameBytes []byte // []byte(name)
+
+	tag       bool
+	index     []int
+	typ       reflect.Type
+	omitEmpty bool
+	quoted    bool
+}
+
+func fillField(f field) field {
+	f.nameBytes = []byte(f.name)
+	return f
+}
+
+// byName sorts field by name, breaking ties with depth,
+// then breaking ties with "name came from json tag", then
+// breaking ties with index sequence.
+type byName []field
+
+func (x byName) Len() int { return len(x) }
+
+func (x byName) Swap(i, j int) { x[i], x[j] = x[j], x[i] }
+
+func (x byName) Less(i, j int) bool {
+	if x[i].name != x[j].name {
+		return x[i].name < x[j].name
+	}
+	if len(x[i].index) != len(x[j].index) {
+		return len(x[i].index) < len(x[j].index)
+	}
+	if x[i].tag != x[j].tag {
+		return x[i].tag
+	}
+	return byIndex(x).Less(i, j)
+}
+
+// byIndex sorts field by index sequence.
+type byIndex []field
+
+func (x byIndex) Len() int { return len(x) }
+
+func (x byIndex) Swap(i, j int) { x[i], x[j] = x[j], x[i] }
+
+func (x byIndex) Less(i, j int) bool {
+	for k, xik := range x[i].index {
+		if k >= len(x[j].index) {
+			return false
+		}
+		if xik != x[j].index[k] {
+			return xik < x[j].index[k]
+		}
+	}
+	return len(x[i].index) < len(x[j].index)
+}
+
+// typeFields returns a list of fields that JSON should recognize for the given type.
+// The algorithm is breadth-first search over the set of structs to include - the top struct
+// and then any reachable anonymous structs.
+func typeFields(t reflect.Type) []field {
+	// Anonymous fields to explore at the current level and the next.
+	current := []field{}
+	next := []field{{typ: t}}
+
+	// Count of queued names for current level and the next.
+	count := map[reflect.Type]int{}
+	nextCount := map[reflect.Type]int{}
+
+	// Types already visited at an earlier level.
+	visited := map[reflect.Type]bool{}
+
+	// Fields found.
+	var fields []field
+
+	for len(next) > 0 {
+		current, next = next, current[:0]
+		count, nextCount = nextCount, map[reflect.Type]int{}
+
+		for _, f := range current {
+			if visited[f.typ] {
+				continue
+			}
+			visited[f.typ] = true
+
+			// Scan f.typ for fields to include.
+			for i := 0; i < f.typ.NumField(); i++ {
+				sf := f.typ.Field(i)
+				if sf.PkgPath != "" && !sf.Anonymous { // unexported
+					continue
+				}
+				tag := sf.Tag.Get("json")
+				if tag == "-" {
+					continue
+				}
+				name, opts := parseTag(tag)
+				if !isValidTag(name) {
+					name = ""
+				}
+				index := make([]int, len(f.index)+1)
+				copy(index, f.index)
+				index[len(f.index)] = i
+
+				ft := sf.Type
+				if ft.Name() == "" && ft.Kind() == reflect.Ptr {
+					// Follow pointer.
+					ft = ft.Elem()
+				}
+
+				// Only strings, floats, integers, and booleans can be quoted.
+				quoted := false
+				if opts.Contains("string") {
+					switch ft.Kind() {
+					case reflect.Bool,
+						reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64,
+						reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64,
+						reflect.Float32, reflect.Float64,
+						reflect.String:
+						quoted = true
+					}
+				}
+
+				// Record found field and index sequence.
+				if name != "" || !sf.Anonymous || ft.Kind() != reflect.Struct {
+					tagged := name != ""
+					if name == "" {
+						name = sf.Name
+					}
+					fields = append(fields, fillField(field{
+						name:      name,
+						tag:       tagged,
+						index:     index,
+						typ:       ft,
+						omitEmpty: opts.Contains("omitempty"),
+						quoted:    quoted,
+					}))
+					if count[f.typ] > 1 {
+						// If there were multiple instances, add a second,
+						// so that the annihilation code will see a duplicate.
+						// It only cares about the distinction between 1 or 2,
+						// so don't bother generating any more copies.
+						fields = append(fields, fields[len(fields)-1])
+					}
+					continue
+				}
+
+				// Record new anonymous struct to explore in next round.
+				nextCount[ft]++
+				if nextCount[ft] == 1 {
+					next = append(next, fillField(field{name: ft.Name(), index: index, typ: ft}))
+				}
+			}
+		}
+	}
+
+	sort.Sort(byName(fields))
+
+	// Delete all fields that are hidden by the Go rules for embedded fields,
+	// except that fields with JSON tags are promoted.
+
+	// The fields are sorted in primary order of name, secondary order
+	// of field index length. Loop over names; for each name, delete
+	// hidden fields by choosing the one dominant field that survives.
+	out := fields[:0]
+	for advance, i := 0, 0; i < len(fields); i += advance {
+		// One iteration per name.
+		// Find the sequence of fields with the name of this first field.
+		fi := fields[i]
+		name := fi.name
+		for advance = 1; i+advance < len(fields); advance++ {
+			fj := fields[i+advance]
+			if fj.name != name {
+				break
+			}
+		}
+		if advance == 1 { // Only one field with this name
+			out = append(out, fi)
+			continue
+		}
+		dominant, ok := dominantField(fields[i : i+advance])
+		if ok {
+			out = append(out, dominant)
+		}
+	}
+
+	fields = out
+	sort.Sort(byIndex(fields))
+
+	return fields
+}
+
+// dominantField looks through the fields, all of which are known to
+// have the same name, to find the single field that dominates the
+// others using Go's embedding rules, modified by the presence of
+// JSON tags. If there are multiple top-level fields, the boolean
+// will be false: This condition is an error in Go and we skip all
+// the fields.
+func dominantField(fields []field) (field, bool) {
+	// The fields are sorted in increasing index-length order. The winner
+	// must therefore be one with the shortest index length. Drop all
+	// longer entries, which is easy: just truncate the slice.
+	length := len(fields[0].index)
+	tagged := -1 // Index of first tagged field.
+	for i, f := range fields {
+		if len(f.index) > length {
+			fields = fields[:i]
+			break
+		}
+		if f.tag {
+			if tagged >= 0 {
+				// Multiple tagged fields at the same level: conflict.
+				// Return no field.
+				return field{}, false
+			}
+			tagged = i
+		}
+	}
+	if tagged >= 0 {
+		return fields[tagged], true
+	}
+	// All remaining fields have the same length. If there's more than one,
+	// we have a conflict (two fields named "X" at the same level) and we
+	// return no field.
+	if len(fields) > 1 {
+		return field{}, false
+	}
+	return fields[0], true
+}
+
+var fieldCache struct {
+	sync.RWMutex
+	m map[reflect.Type][]field
+}
+
+// cachedTypeFields is like typeFields but uses a cache to avoid repeated work.
+func cachedTypeFields(t reflect.Type) []field {
+	fieldCache.RLock()
+	f := fieldCache.m[t]
+	fieldCache.RUnlock()
+	if f != nil {
+		return f
+	}
+
+	// Compute fields without lock.
+	// Might duplicate effort but won't hold other computations back.
+	f = typeFields(t)
+	if f == nil {
+		f = []field{}
+	}
+
+	fieldCache.Lock()
+	if fieldCache.m == nil {
+		fieldCache.m = map[reflect.Type][]field{}
+	}
+	fieldCache.m[t] = f
+	fieldCache.Unlock()
+	return f
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/json/encode_test.go b/vendor/gopkg.in/square/go-jose.v2/json/encode_test.go
new file mode 100644
index 0000000..c00491e
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/json/encode_test.go
@@ -0,0 +1,538 @@
+// Copyright 2011 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package json
+
+import (
+	"bytes"
+	"math"
+	"reflect"
+	"testing"
+	"unicode"
+)
+
+type Optionals struct {
+	Sr string `json:"sr"`
+	So string `json:"so,omitempty"`
+	Sw string `json:"-"`
+
+	Ir int `json:"omitempty"` // actually named omitempty, not an option
+	Io int `json:"io,omitempty"`
+
+	Slr []string `json:"slr,random"`
+	Slo []string `json:"slo,omitempty"`
+
+	Mr map[string]interface{} `json:"mr"`
+	Mo map[string]interface{} `json:",omitempty"`
+
+	Fr float64 `json:"fr"`
+	Fo float64 `json:"fo,omitempty"`
+
+	Br bool `json:"br"`
+	Bo bool `json:"bo,omitempty"`
+
+	Ur uint `json:"ur"`
+	Uo uint `json:"uo,omitempty"`
+
+	Str struct{} `json:"str"`
+	Sto struct{} `json:"sto,omitempty"`
+}
+
+var optionalsExpected = `{
+ "sr": "",
+ "omitempty": 0,
+ "slr": null,
+ "mr": {},
+ "fr": 0,
+ "br": false,
+ "ur": 0,
+ "str": {},
+ "sto": {}
+}`
+
+func TestOmitEmpty(t *testing.T) {
+	var o Optionals
+	o.Sw = "something"
+	o.Mr = map[string]interface{}{}
+	o.Mo = map[string]interface{}{}
+
+	got, err := MarshalIndent(&o, "", " ")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := string(got); got != optionalsExpected {
+		t.Errorf(" got: %s\nwant: %s\n", got, optionalsExpected)
+	}
+}
+
+type StringTag struct {
+	BoolStr bool   `json:",string"`
+	IntStr  int64  `json:",string"`
+	StrStr  string `json:",string"`
+}
+
+var stringTagExpected = `{
+ "BoolStr": "true",
+ "IntStr": "42",
+ "StrStr": "\"xzbit\""
+}`
+
+func TestStringTag(t *testing.T) {
+	var s StringTag
+	s.BoolStr = true
+	s.IntStr = 42
+	s.StrStr = "xzbit"
+	got, err := MarshalIndent(&s, "", " ")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := string(got); got != stringTagExpected {
+		t.Fatalf(" got: %s\nwant: %s\n", got, stringTagExpected)
+	}
+
+	// Verify that it round-trips.
+	var s2 StringTag
+	err = NewDecoder(bytes.NewReader(got)).Decode(&s2)
+	if err != nil {
+		t.Fatalf("Decode: %v", err)
+	}
+	if !reflect.DeepEqual(s, s2) {
+		t.Fatalf("decode didn't match.\nsource: %#v\nEncoded as:\n%s\ndecode: %#v", s, string(got), s2)
+	}
+}
+
+// byte slices are special even if they're renamed types.
+type renamedByte byte
+type renamedByteSlice []byte
+type renamedRenamedByteSlice []renamedByte
+
+func TestEncodeRenamedByteSlice(t *testing.T) {
+	s := renamedByteSlice("abc")
+	result, err := Marshal(s)
+	if err != nil {
+		t.Fatal(err)
+	}
+	expect := `"YWJj"`
+	if string(result) != expect {
+		t.Errorf(" got %s want %s", result, expect)
+	}
+	r := renamedRenamedByteSlice("abc")
+	result, err = Marshal(r)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(result) != expect {
+		t.Errorf(" got %s want %s", result, expect)
+	}
+}
+
+var unsupportedValues = []interface{}{
+	math.NaN(),
+	math.Inf(-1),
+	math.Inf(1),
+}
+
+func TestUnsupportedValues(t *testing.T) {
+	for _, v := range unsupportedValues {
+		if _, err := Marshal(v); err != nil {
+			if _, ok := err.(*UnsupportedValueError); !ok {
+				t.Errorf("for %v, got %T want UnsupportedValueError", v, err)
+			}
+		} else {
+			t.Errorf("for %v, expected error", v)
+		}
+	}
+}
+
+// Ref has Marshaler and Unmarshaler methods with pointer receiver.
+type Ref int
+
+func (*Ref) MarshalJSON() ([]byte, error) {
+	return []byte(`"ref"`), nil
+}
+
+func (r *Ref) UnmarshalJSON([]byte) error {
+	*r = 12
+	return nil
+}
+
+// Val has Marshaler methods with value receiver.
+type Val int
+
+func (Val) MarshalJSON() ([]byte, error) {
+	return []byte(`"val"`), nil
+}
+
+// RefText has Marshaler and Unmarshaler methods with pointer receiver.
+type RefText int
+
+func (*RefText) MarshalText() ([]byte, error) {
+	return []byte(`"ref"`), nil
+}
+
+func (r *RefText) UnmarshalText([]byte) error {
+	*r = 13
+	return nil
+}
+
+// ValText has Marshaler methods with value receiver.
+type ValText int
+
+func (ValText) MarshalText() ([]byte, error) {
+	return []byte(`"val"`), nil
+}
+
+func TestRefValMarshal(t *testing.T) {
+	var s = struct {
+		R0 Ref
+		R1 *Ref
+		R2 RefText
+		R3 *RefText
+		V0 Val
+		V1 *Val
+		V2 ValText
+		V3 *ValText
+	}{
+		R0: 12,
+		R1: new(Ref),
+		R2: 14,
+		R3: new(RefText),
+		V0: 13,
+		V1: new(Val),
+		V2: 15,
+		V3: new(ValText),
+	}
+	const want = `{"R0":"ref","R1":"ref","R2":"\"ref\"","R3":"\"ref\"","V0":"val","V1":"val","V2":"\"val\"","V3":"\"val\""}`
+	b, err := Marshal(&s)
+	if err != nil {
+		t.Fatalf("Marshal: %v", err)
+	}
+	if got := string(b); got != want {
+		t.Errorf("got %q, want %q", got, want)
+	}
+}
+
+// C implements Marshaler and returns unescaped JSON.
+type C int
+
+func (C) MarshalJSON() ([]byte, error) {
+	return []byte(`"<&>"`), nil
+}
+
+// CText implements Marshaler and returns unescaped text.
+type CText int
+
+func (CText) MarshalText() ([]byte, error) {
+	return []byte(`"<&>"`), nil
+}
+
+func TestMarshalerEscaping(t *testing.T) {
+	var c C
+	want := `"\u003c\u0026\u003e"`
+	b, err := Marshal(c)
+	if err != nil {
+		t.Fatalf("Marshal(c): %v", err)
+	}
+	if got := string(b); got != want {
+		t.Errorf("Marshal(c) = %#q, want %#q", got, want)
+	}
+
+	var ct CText
+	want = `"\"\u003c\u0026\u003e\""`
+	b, err = Marshal(ct)
+	if err != nil {
+		t.Fatalf("Marshal(ct): %v", err)
+	}
+	if got := string(b); got != want {
+		t.Errorf("Marshal(ct) = %#q, want %#q", got, want)
+	}
+}
+
+type IntType int
+
+type MyStruct struct {
+	IntType
+}
+
+func TestAnonymousNonstruct(t *testing.T) {
+	var i IntType = 11
+	a := MyStruct{i}
+	const want = `{"IntType":11}`
+
+	b, err := Marshal(a)
+	if err != nil {
+		t.Fatalf("Marshal: %v", err)
+	}
+	if got := string(b); got != want {
+		t.Errorf("got %q, want %q", got, want)
+	}
+}
+
+type BugA struct {
+	S string
+}
+
+type BugB struct {
+	BugA
+	S string
+}
+
+type BugC struct {
+	S string
+}
+
+// Legal Go: We never use the repeated embedded field (S).
+type BugX struct {
+	A int
+	BugA
+	BugB
+}
+
+// Issue 5245.
+func TestEmbeddedBug(t *testing.T) {
+	v := BugB{
+		BugA{"A"},
+		"B",
+	}
+	b, err := Marshal(v)
+	if err != nil {
+		t.Fatal("Marshal:", err)
+	}
+	want := `{"S":"B"}`
+	got := string(b)
+	if got != want {
+		t.Fatalf("Marshal: got %s want %s", got, want)
+	}
+	// Now check that the duplicate field, S, does not appear.
+	x := BugX{
+		A: 23,
+	}
+	b, err = Marshal(x)
+	if err != nil {
+		t.Fatal("Marshal:", err)
+	}
+	want = `{"A":23}`
+	got = string(b)
+	if got != want {
+		t.Fatalf("Marshal: got %s want %s", got, want)
+	}
+}
+
+type BugD struct { // Same as BugA after tagging.
+	XXX string `json:"S"`
+}
+
+// BugD's tagged S field should dominate BugA's.
+type BugY struct {
+	BugA
+	BugD
+}
+
+// Test that a field with a tag dominates untagged fields.
+func TestTaggedFieldDominates(t *testing.T) {
+	v := BugY{
+		BugA{"BugA"},
+		BugD{"BugD"},
+	}
+	b, err := Marshal(v)
+	if err != nil {
+		t.Fatal("Marshal:", err)
+	}
+	want := `{"S":"BugD"}`
+	got := string(b)
+	if got != want {
+		t.Fatalf("Marshal: got %s want %s", got, want)
+	}
+}
+
+// There are no tags here, so S should not appear.
+type BugZ struct {
+	BugA
+	BugC
+	BugY // Contains a tagged S field through BugD; should not dominate.
+}
+
+func TestDuplicatedFieldDisappears(t *testing.T) {
+	v := BugZ{
+		BugA{"BugA"},
+		BugC{"BugC"},
+		BugY{
+			BugA{"nested BugA"},
+			BugD{"nested BugD"},
+		},
+	}
+	b, err := Marshal(v)
+	if err != nil {
+		t.Fatal("Marshal:", err)
+	}
+	want := `{}`
+	got := string(b)
+	if got != want {
+		t.Fatalf("Marshal: got %s want %s", got, want)
+	}
+}
+
+func TestStringBytes(t *testing.T) {
+	// Test that encodeState.stringBytes and encodeState.string use the same encoding.
+	es := &encodeState{}
+	var r []rune
+	for i := '\u0000'; i <= unicode.MaxRune; i++ {
+		r = append(r, i)
+	}
+	s := string(r) + "\xff\xff\xffhello" // some invalid UTF-8 too
+	es.string(s)
+
+	esBytes := &encodeState{}
+	esBytes.stringBytes([]byte(s))
+
+	enc := es.Buffer.String()
+	encBytes := esBytes.Buffer.String()
+	if enc != encBytes {
+		i := 0
+		for i < len(enc) && i < len(encBytes) && enc[i] == encBytes[i] {
+			i++
+		}
+		enc = enc[i:]
+		encBytes = encBytes[i:]
+		i = 0
+		for i < len(enc) && i < len(encBytes) && enc[len(enc)-i-1] == encBytes[len(encBytes)-i-1] {
+			i++
+		}
+		enc = enc[:len(enc)-i]
+		encBytes = encBytes[:len(encBytes)-i]
+
+		if len(enc) > 20 {
+			enc = enc[:20] + "..."
+		}
+		if len(encBytes) > 20 {
+			encBytes = encBytes[:20] + "..."
+		}
+
+		t.Errorf("encodings differ at %#q vs %#q", enc, encBytes)
+	}
+}
+
+func TestIssue6458(t *testing.T) {
+	type Foo struct {
+		M RawMessage
+	}
+	x := Foo{RawMessage(`"foo"`)}
+
+	b, err := Marshal(&x)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if want := `{"M":"foo"}`; string(b) != want {
+		t.Errorf("Marshal(&x) = %#q; want %#q", b, want)
+	}
+
+	b, err = Marshal(x)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if want := `{"M":"ImZvbyI="}`; string(b) != want {
+		t.Errorf("Marshal(x) = %#q; want %#q", b, want)
+	}
+}
+
+func TestIssue10281(t *testing.T) {
+	type Foo struct {
+		N Number
+	}
+	x := Foo{Number(`invalid`)}
+
+	b, err := Marshal(&x)
+	if err == nil {
+		t.Errorf("Marshal(&x) = %#q; want error", b)
+	}
+}
+
+func TestHTMLEscape(t *testing.T) {
+	var b, want bytes.Buffer
+	m := `{"M":"<html>foo &` + "\xe2\x80\xa8 \xe2\x80\xa9" + `</html>"}`
+	want.Write([]byte(`{"M":"\u003chtml\u003efoo \u0026\u2028 \u2029\u003c/html\u003e"}`))
+	HTMLEscape(&b, []byte(m))
+	if !bytes.Equal(b.Bytes(), want.Bytes()) {
+		t.Errorf("HTMLEscape(&b, []byte(m)) = %s; want %s", b.Bytes(), want.Bytes())
+	}
+}
+
+// golang.org/issue/8582
+func TestEncodePointerString(t *testing.T) {
+	type stringPointer struct {
+		N *int64 `json:"n,string"`
+	}
+	var n int64 = 42
+	b, err := Marshal(stringPointer{N: &n})
+	if err != nil {
+		t.Fatalf("Marshal: %v", err)
+	}
+	if got, want := string(b), `{"n":"42"}`; got != want {
+		t.Errorf("Marshal = %s, want %s", got, want)
+	}
+	var back stringPointer
+	err = Unmarshal(b, &back)
+	if err != nil {
+		t.Fatalf("Unmarshal: %v", err)
+	}
+	if back.N == nil {
+		t.Fatalf("Unmarshalled nil N field")
+	}
+	if *back.N != 42 {
+		t.Fatalf("*N = %d; want 42", *back.N)
+	}
+}
+
+var encodeStringTests = []struct {
+	in  string
+	out string
+}{
+	{"\x00", `"\u0000"`},
+	{"\x01", `"\u0001"`},
+	{"\x02", `"\u0002"`},
+	{"\x03", `"\u0003"`},
+	{"\x04", `"\u0004"`},
+	{"\x05", `"\u0005"`},
+	{"\x06", `"\u0006"`},
+	{"\x07", `"\u0007"`},
+	{"\x08", `"\u0008"`},
+	{"\x09", `"\t"`},
+	{"\x0a", `"\n"`},
+	{"\x0b", `"\u000b"`},
+	{"\x0c", `"\u000c"`},
+	{"\x0d", `"\r"`},
+	{"\x0e", `"\u000e"`},
+	{"\x0f", `"\u000f"`},
+	{"\x10", `"\u0010"`},
+	{"\x11", `"\u0011"`},
+	{"\x12", `"\u0012"`},
+	{"\x13", `"\u0013"`},
+	{"\x14", `"\u0014"`},
+	{"\x15", `"\u0015"`},
+	{"\x16", `"\u0016"`},
+	{"\x17", `"\u0017"`},
+	{"\x18", `"\u0018"`},
+	{"\x19", `"\u0019"`},
+	{"\x1a", `"\u001a"`},
+	{"\x1b", `"\u001b"`},
+	{"\x1c", `"\u001c"`},
+	{"\x1d", `"\u001d"`},
+	{"\x1e", `"\u001e"`},
+	{"\x1f", `"\u001f"`},
+}
+
+func TestEncodeString(t *testing.T) {
+	for _, tt := range encodeStringTests {
+		b, err := Marshal(tt.in)
+		if err != nil {
+			t.Errorf("Marshal(%q): %v", tt.in, err)
+			continue
+		}
+		out := string(b)
+		if out != tt.out {
+			t.Errorf("Marshal(%q) = %#q, want %#q", tt.in, out, tt.out)
+		}
+	}
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/json/indent.go b/vendor/gopkg.in/square/go-jose.v2/json/indent.go
new file mode 100644
index 0000000..7cd9f4d
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/json/indent.go
@@ -0,0 +1,141 @@
+// Copyright 2010 The Go Authors.  All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package json
+
+import "bytes"
+
+// Compact appends to dst the JSON-encoded src with
+// insignificant space characters elided.
+func Compact(dst *bytes.Buffer, src []byte) error {
+	return compact(dst, src, false)
+}
+
+func compact(dst *bytes.Buffer, src []byte, escape bool) error {
+	origLen := dst.Len()
+	var scan scanner
+	scan.reset()
+	start := 0
+	for i, c := range src {
+		if escape && (c == '<' || c == '>' || c == '&') {
+			if start < i {
+				dst.Write(src[start:i])
+			}
+			dst.WriteString(`\u00`)
+			dst.WriteByte(hex[c>>4])
+			dst.WriteByte(hex[c&0xF])
+			start = i + 1
+		}
+		// Convert U+2028 and U+2029 (E2 80 A8 and E2 80 A9).
+		if c == 0xE2 && i+2 < len(src) && src[i+1] == 0x80 && src[i+2]&^1 == 0xA8 {
+			if start < i {
+				dst.Write(src[start:i])
+			}
+			dst.WriteString(`\u202`)
+			dst.WriteByte(hex[src[i+2]&0xF])
+			start = i + 3
+		}
+		v := scan.step(&scan, c)
+		if v >= scanSkipSpace {
+			if v == scanError {
+				break
+			}
+			if start < i {
+				dst.Write(src[start:i])
+			}
+			start = i + 1
+		}
+	}
+	if scan.eof() == scanError {
+		dst.Truncate(origLen)
+		return scan.err
+	}
+	if start < len(src) {
+		dst.Write(src[start:])
+	}
+	return nil
+}
+
+func newline(dst *bytes.Buffer, prefix, indent string, depth int) {
+	dst.WriteByte('\n')
+	dst.WriteString(prefix)
+	for i := 0; i < depth; i++ {
+		dst.WriteString(indent)
+	}
+}
+
+// Indent appends to dst an indented form of the JSON-encoded src.
+// Each element in a JSON object or array begins on a new,
+// indented line beginning with prefix followed by one or more
+// copies of indent according to the indentation nesting.
+// The data appended to dst does not begin with the prefix nor
+// any indentation, to make it easier to embed inside other formatted JSON data.
+// Although leading space characters (space, tab, carriage return, newline)
+// at the beginning of src are dropped, trailing space characters
+// at the end of src are preserved and copied to dst.
+// For example, if src has no trailing spaces, neither will dst;
+// if src ends in a trailing newline, so will dst.
+func Indent(dst *bytes.Buffer, src []byte, prefix, indent string) error {
+	origLen := dst.Len()
+	var scan scanner
+	scan.reset()
+	needIndent := false
+	depth := 0
+	for _, c := range src {
+		scan.bytes++
+		v := scan.step(&scan, c)
+		if v == scanSkipSpace {
+			continue
+		}
+		if v == scanError {
+			break
+		}
+		if needIndent && v != scanEndObject && v != scanEndArray {
+			needIndent = false
+			depth++
+			newline(dst, prefix, indent, depth)
+		}
+
+		// Emit semantically uninteresting bytes
+		// (in particular, punctuation in strings) unmodified.
+		if v == scanContinue {
+			dst.WriteByte(c)
+			continue
+		}
+
+		// Add spacing around real punctuation.
+		switch c {
+		case '{', '[':
+			// delay indent so that empty object and array are formatted as {} and [].
+			needIndent = true
+			dst.WriteByte(c)
+
+		case ',':
+			dst.WriteByte(c)
+			newline(dst, prefix, indent, depth)
+
+		case ':':
+			dst.WriteByte(c)
+			dst.WriteByte(' ')
+
+		case '}', ']':
+			if needIndent {
+				// suppress indent in empty object/array
+				needIndent = false
+			} else {
+				depth--
+				newline(dst, prefix, indent, depth)
+			}
+			dst.WriteByte(c)
+
+		default:
+			dst.WriteByte(c)
+		}
+	}
+	if scan.eof() == scanError {
+		dst.Truncate(origLen)
+		return scan.err
+	}
+	return nil
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/json/number_test.go b/vendor/gopkg.in/square/go-jose.v2/json/number_test.go
new file mode 100644
index 0000000..4e63cf9
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/json/number_test.go
@@ -0,0 +1,133 @@
+// Copyright 2011 The Go Authors.  All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package json
+
+import (
+	"regexp"
+	"testing"
+)
+
+func TestNumberIsValid(t *testing.T) {
+	// From: http://stackoverflow.com/a/13340826
+	var jsonNumberRegexp = regexp.MustCompile(`^-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?$`)
+
+	validTests := []string{
+		"0",
+		"-0",
+		"1",
+		"-1",
+		"0.1",
+		"-0.1",
+		"1234",
+		"-1234",
+		"12.34",
+		"-12.34",
+		"12E0",
+		"12E1",
+		"12e34",
+		"12E-0",
+		"12e+1",
+		"12e-34",
+		"-12E0",
+		"-12E1",
+		"-12e34",
+		"-12E-0",
+		"-12e+1",
+		"-12e-34",
+		"1.2E0",
+		"1.2E1",
+		"1.2e34",
+		"1.2E-0",
+		"1.2e+1",
+		"1.2e-34",
+		"-1.2E0",
+		"-1.2E1",
+		"-1.2e34",
+		"-1.2E-0",
+		"-1.2e+1",
+		"-1.2e-34",
+		"0E0",
+		"0E1",
+		"0e34",
+		"0E-0",
+		"0e+1",
+		"0e-34",
+		"-0E0",
+		"-0E1",
+		"-0e34",
+		"-0E-0",
+		"-0e+1",
+		"-0e-34",
+	}
+
+	for _, test := range validTests {
+		if !isValidNumber(test) {
+			t.Errorf("%s should be valid", test)
+		}
+
+		var f float64
+		if err := Unmarshal([]byte(test), &f); err != nil {
+			t.Errorf("%s should be valid but Unmarshal failed: %v", test, err)
+		}
+
+		if !jsonNumberRegexp.MatchString(test) {
+			t.Errorf("%s should be valid but regexp does not match", test)
+		}
+	}
+
+	invalidTests := []string{
+		"",
+		"invalid",
+		"1.0.1",
+		"1..1",
+		"-1-2",
+		"012a42",
+		"01.2",
+		"012",
+		"12E12.12",
+		"1e2e3",
+		"1e+-2",
+		"1e--23",
+		"1e",
+		"e1",
+		"1e+",
+		"1ea",
+		"1a",
+		"1.a",
+		"1.",
+		"01",
+		"1.e1",
+	}
+
+	for _, test := range invalidTests {
+		if isValidNumber(test) {
+			t.Errorf("%s should be invalid", test)
+		}
+
+		var f float64
+		if err := Unmarshal([]byte(test), &f); err == nil {
+			t.Errorf("%s should be invalid but unmarshal wrote %v", test, f)
+		}
+
+		if jsonNumberRegexp.MatchString(test) {
+			t.Errorf("%s should be invalid but matches regexp", test)
+		}
+	}
+}
+
+func BenchmarkNumberIsValid(b *testing.B) {
+	s := "-61657.61667E+61673"
+	for i := 0; i < b.N; i++ {
+		isValidNumber(s)
+	}
+}
+
+func BenchmarkNumberIsValidRegexp(b *testing.B) {
+	var jsonNumberRegexp = regexp.MustCompile(`^-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?$`)
+	s := "-61657.61667E+61673"
+	for i := 0; i < b.N; i++ {
+		jsonNumberRegexp.MatchString(s)
+	}
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/json/scanner.go b/vendor/gopkg.in/square/go-jose.v2/json/scanner.go
new file mode 100644
index 0000000..ee6622e
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/json/scanner.go
@@ -0,0 +1,623 @@
+// Copyright 2010 The Go Authors.  All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package json
+
+// JSON value parser state machine.
+// Just about at the limit of what is reasonable to write by hand.
+// Some parts are a bit tedious, but overall it nicely factors out the
+// otherwise common code from the multiple scanning functions
+// in this package (Compact, Indent, checkValid, nextValue, etc).
+//
+// This file starts with two simple examples using the scanner
+// before diving into the scanner itself.
+
+import "strconv"
+
+// checkValid verifies that data is valid JSON-encoded data.
+// scan is passed in for use by checkValid to avoid an allocation.
+func checkValid(data []byte, scan *scanner) error {
+	scan.reset()
+	for _, c := range data {
+		scan.bytes++
+		if scan.step(scan, c) == scanError {
+			return scan.err
+		}
+	}
+	if scan.eof() == scanError {
+		return scan.err
+	}
+	return nil
+}
+
+// nextValue splits data after the next whole JSON value,
+// returning that value and the bytes that follow it as separate slices.
+// scan is passed in for use by nextValue to avoid an allocation.
+func nextValue(data []byte, scan *scanner) (value, rest []byte, err error) {
+	scan.reset()
+	for i, c := range data {
+		v := scan.step(scan, c)
+		if v >= scanEndObject {
+			switch v {
+			// probe the scanner with a space to determine whether we will
+			// get scanEnd on the next character. Otherwise, if the next character
+			// is not a space, scanEndTop allocates a needless error.
+			case scanEndObject, scanEndArray:
+				if scan.step(scan, ' ') == scanEnd {
+					return data[:i+1], data[i+1:], nil
+				}
+			case scanError:
+				return nil, nil, scan.err
+			case scanEnd:
+				return data[:i], data[i:], nil
+			}
+		}
+	}
+	if scan.eof() == scanError {
+		return nil, nil, scan.err
+	}
+	return data, nil, nil
+}
+
+// A SyntaxError is a description of a JSON syntax error.
+type SyntaxError struct {
+	msg    string // description of error
+	Offset int64  // error occurred after reading Offset bytes
+}
+
+func (e *SyntaxError) Error() string { return e.msg }
+
+// A scanner is a JSON scanning state machine.
+// Callers call scan.reset() and then pass bytes in one at a time
+// by calling scan.step(&scan, c) for each byte.
+// The return value, referred to as an opcode, tells the
+// caller about significant parsing events like beginning
+// and ending literals, objects, and arrays, so that the
+// caller can follow along if it wishes.
+// The return value scanEnd indicates that a single top-level
+// JSON value has been completed, *before* the byte that
+// just got passed in.  (The indication must be delayed in order
+// to recognize the end of numbers: is 123 a whole value or
+// the beginning of 12345e+6?).
+type scanner struct {
+	// The step is a func to be called to execute the next transition.
+	// Also tried using an integer constant and a single func
+	// with a switch, but using the func directly was 10% faster
+	// on a 64-bit Mac Mini, and it's nicer to read.
+	step func(*scanner, byte) int
+
+	// Reached end of top-level value.
+	endTop bool
+
+	// Stack of what we're in the middle of - array values, object keys, object values.
+	parseState []int
+
+	// Error that happened, if any.
+	err error
+
+	// 1-byte redo (see undo method)
+	redo      bool
+	redoCode  int
+	redoState func(*scanner, byte) int
+
+	// total bytes consumed, updated by decoder.Decode
+	bytes int64
+}
+
+// These values are returned by the state transition functions
+// assigned to scanner.state and the method scanner.eof.
+// They give details about the current state of the scan that
+// callers might be interested to know about.
+// It is okay to ignore the return value of any particular
+// call to scanner.state: if one call returns scanError,
+// every subsequent call will return scanError too.
+const (
+	// Continue.
+	scanContinue     = iota // uninteresting byte
+	scanBeginLiteral        // end implied by next result != scanContinue
+	scanBeginObject         // begin object
+	scanObjectKey           // just finished object key (string)
+	scanObjectValue         // just finished non-last object value
+	scanEndObject           // end object (implies scanObjectValue if possible)
+	scanBeginArray          // begin array
+	scanArrayValue          // just finished array value
+	scanEndArray            // end array (implies scanArrayValue if possible)
+	scanSkipSpace           // space byte; can skip; known to be last "continue" result
+
+	// Stop.
+	scanEnd   // top-level value ended *before* this byte; known to be first "stop" result
+	scanError // hit an error, scanner.err.
+)
+
+// These values are stored in the parseState stack.
+// They give the current state of a composite value
+// being scanned.  If the parser is inside a nested value
+// the parseState describes the nested state, outermost at entry 0.
+const (
+	parseObjectKey   = iota // parsing object key (before colon)
+	parseObjectValue        // parsing object value (after colon)
+	parseArrayValue         // parsing array value
+)
+
+// reset prepares the scanner for use.
+// It must be called before calling s.step.
+func (s *scanner) reset() {
+	s.step = stateBeginValue
+	s.parseState = s.parseState[0:0]
+	s.err = nil
+	s.redo = false
+	s.endTop = false
+}
+
+// eof tells the scanner that the end of input has been reached.
+// It returns a scan status just as s.step does.
+func (s *scanner) eof() int {
+	if s.err != nil {
+		return scanError
+	}
+	if s.endTop {
+		return scanEnd
+	}
+	s.step(s, ' ')
+	if s.endTop {
+		return scanEnd
+	}
+	if s.err == nil {
+		s.err = &SyntaxError{"unexpected end of JSON input", s.bytes}
+	}
+	return scanError
+}
+
+// pushParseState pushes a new parse state p onto the parse stack.
+func (s *scanner) pushParseState(p int) {
+	s.parseState = append(s.parseState, p)
+}
+
+// popParseState pops a parse state (already obtained) off the stack
+// and updates s.step accordingly.
+func (s *scanner) popParseState() {
+	n := len(s.parseState) - 1
+	s.parseState = s.parseState[0:n]
+	s.redo = false
+	if n == 0 {
+		s.step = stateEndTop
+		s.endTop = true
+	} else {
+		s.step = stateEndValue
+	}
+}
+
+func isSpace(c byte) bool {
+	return c == ' ' || c == '\t' || c == '\r' || c == '\n'
+}
+
+// stateBeginValueOrEmpty is the state after reading `[`.
+func stateBeginValueOrEmpty(s *scanner, c byte) int {
+	if c <= ' ' && isSpace(c) {
+		return scanSkipSpace
+	}
+	if c == ']' {
+		return stateEndValue(s, c)
+	}
+	return stateBeginValue(s, c)
+}
+
+// stateBeginValue is the state at the beginning of the input.
+func stateBeginValue(s *scanner, c byte) int {
+	if c <= ' ' && isSpace(c) {
+		return scanSkipSpace
+	}
+	switch c {
+	case '{':
+		s.step = stateBeginStringOrEmpty
+		s.pushParseState(parseObjectKey)
+		return scanBeginObject
+	case '[':
+		s.step = stateBeginValueOrEmpty
+		s.pushParseState(parseArrayValue)
+		return scanBeginArray
+	case '"':
+		s.step = stateInString
+		return scanBeginLiteral
+	case '-':
+		s.step = stateNeg
+		return scanBeginLiteral
+	case '0': // beginning of 0.123
+		s.step = state0
+		return scanBeginLiteral
+	case 't': // beginning of true
+		s.step = stateT
+		return scanBeginLiteral
+	case 'f': // beginning of false
+		s.step = stateF
+		return scanBeginLiteral
+	case 'n': // beginning of null
+		s.step = stateN
+		return scanBeginLiteral
+	}
+	if '1' <= c && c <= '9' { // beginning of 1234.5
+		s.step = state1
+		return scanBeginLiteral
+	}
+	return s.error(c, "looking for beginning of value")
+}
+
+// stateBeginStringOrEmpty is the state after reading `{`.
+func stateBeginStringOrEmpty(s *scanner, c byte) int {
+	if c <= ' ' && isSpace(c) {
+		return scanSkipSpace
+	}
+	if c == '}' {
+		n := len(s.parseState)
+		s.parseState[n-1] = parseObjectValue
+		return stateEndValue(s, c)
+	}
+	return stateBeginString(s, c)
+}
+
+// stateBeginString is the state after reading `{"key": value,`.
+func stateBeginString(s *scanner, c byte) int {
+	if c <= ' ' && isSpace(c) {
+		return scanSkipSpace
+	}
+	if c == '"' {
+		s.step = stateInString
+		return scanBeginLiteral
+	}
+	return s.error(c, "looking for beginning of object key string")
+}
+
+// stateEndValue is the state after completing a value,
+// such as after reading `{}` or `true` or `["x"`.
+func stateEndValue(s *scanner, c byte) int {
+	n := len(s.parseState)
+	if n == 0 {
+		// Completed top-level before the current byte.
+		s.step = stateEndTop
+		s.endTop = true
+		return stateEndTop(s, c)
+	}
+	if c <= ' ' && isSpace(c) {
+		s.step = stateEndValue
+		return scanSkipSpace
+	}
+	ps := s.parseState[n-1]
+	switch ps {
+	case parseObjectKey:
+		if c == ':' {
+			s.parseState[n-1] = parseObjectValue
+			s.step = stateBeginValue
+			return scanObjectKey
+		}
+		return s.error(c, "after object key")
+	case parseObjectValue:
+		if c == ',' {
+			s.parseState[n-1] = parseObjectKey
+			s.step = stateBeginString
+			return scanObjectValue
+		}
+		if c == '}' {
+			s.popParseState()
+			return scanEndObject
+		}
+		return s.error(c, "after object key:value pair")
+	case parseArrayValue:
+		if c == ',' {
+			s.step = stateBeginValue
+			return scanArrayValue
+		}
+		if c == ']' {
+			s.popParseState()
+			return scanEndArray
+		}
+		return s.error(c, "after array element")
+	}
+	return s.error(c, "")
+}
+
+// stateEndTop is the state after finishing the top-level value,
+// such as after reading `{}` or `[1,2,3]`.
+// Only space characters should be seen now.
+func stateEndTop(s *scanner, c byte) int {
+	if c != ' ' && c != '\t' && c != '\r' && c != '\n' {
+		// Complain about non-space byte on next call.
+		s.error(c, "after top-level value")
+	}
+	return scanEnd
+}
+
+// stateInString is the state after reading `"`.
+func stateInString(s *scanner, c byte) int {
+	if c == '"' {
+		s.step = stateEndValue
+		return scanContinue
+	}
+	if c == '\\' {
+		s.step = stateInStringEsc
+		return scanContinue
+	}
+	if c < 0x20 {
+		return s.error(c, "in string literal")
+	}
+	return scanContinue
+}
+
+// stateInStringEsc is the state after reading `"\` during a quoted string.
+func stateInStringEsc(s *scanner, c byte) int {
+	switch c {
+	case 'b', 'f', 'n', 'r', 't', '\\', '/', '"':
+		s.step = stateInString
+		return scanContinue
+	case 'u':
+		s.step = stateInStringEscU
+		return scanContinue
+	}
+	return s.error(c, "in string escape code")
+}
+
+// stateInStringEscU is the state after reading `"\u` during a quoted string.
+func stateInStringEscU(s *scanner, c byte) int {
+	if '0' <= c && c <= '9' || 'a' <= c && c <= 'f' || 'A' <= c && c <= 'F' {
+		s.step = stateInStringEscU1
+		return scanContinue
+	}
+	// numbers
+	return s.error(c, "in \\u hexadecimal character escape")
+}
+
+// stateInStringEscU1 is the state after reading `"\u1` during a quoted string.
+func stateInStringEscU1(s *scanner, c byte) int {
+	if '0' <= c && c <= '9' || 'a' <= c && c <= 'f' || 'A' <= c && c <= 'F' {
+		s.step = stateInStringEscU12
+		return scanContinue
+	}
+	// numbers
+	return s.error(c, "in \\u hexadecimal character escape")
+}
+
+// stateInStringEscU12 is the state after reading `"\u12` during a quoted string.
+func stateInStringEscU12(s *scanner, c byte) int {
+	if '0' <= c && c <= '9' || 'a' <= c && c <= 'f' || 'A' <= c && c <= 'F' {
+		s.step = stateInStringEscU123
+		return scanContinue
+	}
+	// numbers
+	return s.error(c, "in \\u hexadecimal character escape")
+}
+
+// stateInStringEscU123 is the state after reading `"\u123` during a quoted string.
+func stateInStringEscU123(s *scanner, c byte) int {
+	if '0' <= c && c <= '9' || 'a' <= c && c <= 'f' || 'A' <= c && c <= 'F' {
+		s.step = stateInString
+		return scanContinue
+	}
+	// numbers
+	return s.error(c, "in \\u hexadecimal character escape")
+}
+
+// stateNeg is the state after reading `-` during a number.
+func stateNeg(s *scanner, c byte) int {
+	if c == '0' {
+		s.step = state0
+		return scanContinue
+	}
+	if '1' <= c && c <= '9' {
+		s.step = state1
+		return scanContinue
+	}
+	return s.error(c, "in numeric literal")
+}
+
+// state1 is the state after reading a non-zero integer during a number,
+// such as after reading `1` or `100` but not `0`.
+func state1(s *scanner, c byte) int {
+	if '0' <= c && c <= '9' {
+		s.step = state1
+		return scanContinue
+	}
+	return state0(s, c)
+}
+
+// state0 is the state after reading `0` during a number.
+func state0(s *scanner, c byte) int {
+	if c == '.' {
+		s.step = stateDot
+		return scanContinue
+	}
+	if c == 'e' || c == 'E' {
+		s.step = stateE
+		return scanContinue
+	}
+	return stateEndValue(s, c)
+}
+
+// stateDot is the state after reading the integer and decimal point in a number,
+// such as after reading `1.`.
+func stateDot(s *scanner, c byte) int {
+	if '0' <= c && c <= '9' {
+		s.step = stateDot0
+		return scanContinue
+	}
+	return s.error(c, "after decimal point in numeric literal")
+}
+
+// stateDot0 is the state after reading the integer, decimal point, and subsequent
+// digits of a number, such as after reading `3.14`.
+func stateDot0(s *scanner, c byte) int {
+	if '0' <= c && c <= '9' {
+		return scanContinue
+	}
+	if c == 'e' || c == 'E' {
+		s.step = stateE
+		return scanContinue
+	}
+	return stateEndValue(s, c)
+}
+
+// stateE is the state after reading the mantissa and e in a number,
+// such as after reading `314e` or `0.314e`.
+func stateE(s *scanner, c byte) int {
+	if c == '+' || c == '-' {
+		s.step = stateESign
+		return scanContinue
+	}
+	return stateESign(s, c)
+}
+
+// stateESign is the state after reading the mantissa, e, and sign in a number,
+// such as after reading `314e-` or `0.314e+`.
+func stateESign(s *scanner, c byte) int {
+	if '0' <= c && c <= '9' {
+		s.step = stateE0
+		return scanContinue
+	}
+	return s.error(c, "in exponent of numeric literal")
+}
+
+// stateE0 is the state after reading the mantissa, e, optional sign,
+// and at least one digit of the exponent in a number,
+// such as after reading `314e-2` or `0.314e+1` or `3.14e0`.
+func stateE0(s *scanner, c byte) int {
+	if '0' <= c && c <= '9' {
+		return scanContinue
+	}
+	return stateEndValue(s, c)
+}
+
+// stateT is the state after reading `t`.
+func stateT(s *scanner, c byte) int {
+	if c == 'r' {
+		s.step = stateTr
+		return scanContinue
+	}
+	return s.error(c, "in literal true (expecting 'r')")
+}
+
+// stateTr is the state after reading `tr`.
+func stateTr(s *scanner, c byte) int {
+	if c == 'u' {
+		s.step = stateTru
+		return scanContinue
+	}
+	return s.error(c, "in literal true (expecting 'u')")
+}
+
+// stateTru is the state after reading `tru`.
+func stateTru(s *scanner, c byte) int {
+	if c == 'e' {
+		s.step = stateEndValue
+		return scanContinue
+	}
+	return s.error(c, "in literal true (expecting 'e')")
+}
+
+// stateF is the state after reading `f`.
+func stateF(s *scanner, c byte) int {
+	if c == 'a' {
+		s.step = stateFa
+		return scanContinue
+	}
+	return s.error(c, "in literal false (expecting 'a')")
+}
+
+// stateFa is the state after reading `fa`.
+func stateFa(s *scanner, c byte) int {
+	if c == 'l' {
+		s.step = stateFal
+		return scanContinue
+	}
+	return s.error(c, "in literal false (expecting 'l')")
+}
+
+// stateFal is the state after reading `fal`.
+func stateFal(s *scanner, c byte) int {
+	if c == 's' {
+		s.step = stateFals
+		return scanContinue
+	}
+	return s.error(c, "in literal false (expecting 's')")
+}
+
+// stateFals is the state after reading `fals`.
+func stateFals(s *scanner, c byte) int {
+	if c == 'e' {
+		s.step = stateEndValue
+		return scanContinue
+	}
+	return s.error(c, "in literal false (expecting 'e')")
+}
+
+// stateN is the state after reading `n`.
+func stateN(s *scanner, c byte) int {
+	if c == 'u' {
+		s.step = stateNu
+		return scanContinue
+	}
+	return s.error(c, "in literal null (expecting 'u')")
+}
+
+// stateNu is the state after reading `nu`.
+func stateNu(s *scanner, c byte) int {
+	if c == 'l' {
+		s.step = stateNul
+		return scanContinue
+	}
+	return s.error(c, "in literal null (expecting 'l')")
+}
+
+// stateNul is the state after reading `nul`.
+func stateNul(s *scanner, c byte) int {
+	if c == 'l' {
+		s.step = stateEndValue
+		return scanContinue
+	}
+	return s.error(c, "in literal null (expecting 'l')")
+}
+
+// stateError is the state after reaching a syntax error,
+// such as after reading `[1}` or `5.1.2`.
+func stateError(s *scanner, c byte) int {
+	return scanError
+}
+
+// error records an error and switches to the error state.
+func (s *scanner) error(c byte, context string) int {
+	s.step = stateError
+	s.err = &SyntaxError{"invalid character " + quoteChar(c) + " " + context, s.bytes}
+	return scanError
+}
+
+// quoteChar formats c as a quoted character literal
+func quoteChar(c byte) string {
+	// special cases - different from quoted strings
+	if c == '\'' {
+		return `'\''`
+	}
+	if c == '"' {
+		return `'"'`
+	}
+
+	// use quoted string with different quotation marks
+	s := strconv.Quote(string(c))
+	return "'" + s[1:len(s)-1] + "'"
+}
+
+// undo causes the scanner to return scanCode from the next state transition.
+// This gives callers a simple 1-byte undo mechanism.
+func (s *scanner) undo(scanCode int) {
+	if s.redo {
+		panic("json: invalid use of scanner")
+	}
+	s.redoCode = scanCode
+	s.redoState = s.step
+	s.step = stateRedo
+	s.redo = true
+}
+
+// stateRedo helps implement the scanner's 1-byte undo.
+func stateRedo(s *scanner, c byte) int {
+	s.redo = false
+	s.step = s.redoState
+	return s.redoCode
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/json/scanner_test.go b/vendor/gopkg.in/square/go-jose.v2/json/scanner_test.go
new file mode 100644
index 0000000..66383ef
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/json/scanner_test.go
@@ -0,0 +1,316 @@
+// Copyright 2010 The Go Authors.  All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package json
+
+import (
+	"bytes"
+	"math"
+	"math/rand"
+	"reflect"
+	"testing"
+)
+
+// Tests of simple examples.
+
+type example struct {
+	compact string
+	indent  string
+}
+
+var examples = []example{
+	{`1`, `1`},
+	{`{}`, `{}`},
+	{`[]`, `[]`},
+	{`{"":2}`, "{\n\t\"\": 2\n}"},
+	{`[3]`, "[\n\t3\n]"},
+	{`[1,2,3]`, "[\n\t1,\n\t2,\n\t3\n]"},
+	{`{"x":1}`, "{\n\t\"x\": 1\n}"},
+	{ex1, ex1i},
+}
+
+var ex1 = `[true,false,null,"x",1,1.5,0,-5e+2]`
+
+var ex1i = `[
+	true,
+	false,
+	null,
+	"x",
+	1,
+	1.5,
+	0,
+	-5e+2
+]`
+
+func TestCompact(t *testing.T) {
+	var buf bytes.Buffer
+	for _, tt := range examples {
+		buf.Reset()
+		if err := Compact(&buf, []byte(tt.compact)); err != nil {
+			t.Errorf("Compact(%#q): %v", tt.compact, err)
+		} else if s := buf.String(); s != tt.compact {
+			t.Errorf("Compact(%#q) = %#q, want original", tt.compact, s)
+		}
+
+		buf.Reset()
+		if err := Compact(&buf, []byte(tt.indent)); err != nil {
+			t.Errorf("Compact(%#q): %v", tt.indent, err)
+			continue
+		} else if s := buf.String(); s != tt.compact {
+			t.Errorf("Compact(%#q) = %#q, want %#q", tt.indent, s, tt.compact)
+		}
+	}
+}
+
+func TestCompactSeparators(t *testing.T) {
+	// U+2028 and U+2029 should be escaped inside strings.
+	// They should not appear outside strings.
+	tests := []struct {
+		in, compact string
+	}{
+		{"{\"\u2028\": 1}", `{"\u2028":1}`},
+		{"{\"\u2029\" :2}", `{"\u2029":2}`},
+	}
+	for _, tt := range tests {
+		var buf bytes.Buffer
+		if err := Compact(&buf, []byte(tt.in)); err != nil {
+			t.Errorf("Compact(%q): %v", tt.in, err)
+		} else if s := buf.String(); s != tt.compact {
+			t.Errorf("Compact(%q) = %q, want %q", tt.in, s, tt.compact)
+		}
+	}
+}
+
+func TestIndent(t *testing.T) {
+	var buf bytes.Buffer
+	for _, tt := range examples {
+		buf.Reset()
+		if err := Indent(&buf, []byte(tt.indent), "", "\t"); err != nil {
+			t.Errorf("Indent(%#q): %v", tt.indent, err)
+		} else if s := buf.String(); s != tt.indent {
+			t.Errorf("Indent(%#q) = %#q, want original", tt.indent, s)
+		}
+
+		buf.Reset()
+		if err := Indent(&buf, []byte(tt.compact), "", "\t"); err != nil {
+			t.Errorf("Indent(%#q): %v", tt.compact, err)
+			continue
+		} else if s := buf.String(); s != tt.indent {
+			t.Errorf("Indent(%#q) = %#q, want %#q", tt.compact, s, tt.indent)
+		}
+	}
+}
+
+// Tests of a large random structure.
+
+func TestCompactBig(t *testing.T) {
+	initBig()
+	var buf bytes.Buffer
+	if err := Compact(&buf, jsonBig); err != nil {
+		t.Fatalf("Compact: %v", err)
+	}
+	b := buf.Bytes()
+	if !bytes.Equal(b, jsonBig) {
+		t.Error("Compact(jsonBig) != jsonBig")
+		diff(t, b, jsonBig)
+		return
+	}
+}
+
+func TestIndentBig(t *testing.T) {
+	initBig()
+	var buf bytes.Buffer
+	if err := Indent(&buf, jsonBig, "", "\t"); err != nil {
+		t.Fatalf("Indent1: %v", err)
+	}
+	b := buf.Bytes()
+	if len(b) == len(jsonBig) {
+		// jsonBig is compact (no unnecessary spaces);
+		// indenting should make it bigger
+		t.Fatalf("Indent(jsonBig) did not get bigger")
+	}
+
+	// should be idempotent
+	var buf1 bytes.Buffer
+	if err := Indent(&buf1, b, "", "\t"); err != nil {
+		t.Fatalf("Indent2: %v", err)
+	}
+	b1 := buf1.Bytes()
+	if !bytes.Equal(b1, b) {
+		t.Error("Indent(Indent(jsonBig)) != Indent(jsonBig)")
+		diff(t, b1, b)
+		return
+	}
+
+	// should get back to original
+	buf1.Reset()
+	if err := Compact(&buf1, b); err != nil {
+		t.Fatalf("Compact: %v", err)
+	}
+	b1 = buf1.Bytes()
+	if !bytes.Equal(b1, jsonBig) {
+		t.Error("Compact(Indent(jsonBig)) != jsonBig")
+		diff(t, b1, jsonBig)
+		return
+	}
+}
+
+type indentErrorTest struct {
+	in  string
+	err error
+}
+
+var indentErrorTests = []indentErrorTest{
+	{`{"X": "foo", "Y"}`, &SyntaxError{"invalid character '}' after object key", 17}},
+	{`{"X": "foo" "Y": "bar"}`, &SyntaxError{"invalid character '\"' after object key:value pair", 13}},
+}
+
+func TestIndentErrors(t *testing.T) {
+	for i, tt := range indentErrorTests {
+		slice := make([]uint8, 0)
+		buf := bytes.NewBuffer(slice)
+		if err := Indent(buf, []uint8(tt.in), "", ""); err != nil {
+			if !reflect.DeepEqual(err, tt.err) {
+				t.Errorf("#%d: Indent: %#v", i, err)
+				continue
+			}
+		}
+	}
+}
+
+func TestNextValueBig(t *testing.T) {
+	initBig()
+	var scan scanner
+	item, rest, err := nextValue(jsonBig, &scan)
+	if err != nil {
+		t.Fatalf("nextValue: %s", err)
+	}
+	if len(item) != len(jsonBig) || &item[0] != &jsonBig[0] {
+		t.Errorf("invalid item: %d %d", len(item), len(jsonBig))
+	}
+	if len(rest) != 0 {
+		t.Errorf("invalid rest: %d", len(rest))
+	}
+
+	item, rest, err = nextValue(append(jsonBig, "HELLO WORLD"...), &scan)
+	if err != nil {
+		t.Fatalf("nextValue extra: %s", err)
+	}
+	if len(item) != len(jsonBig) {
+		t.Errorf("invalid item: %d %d", len(item), len(jsonBig))
+	}
+	if string(rest) != "HELLO WORLD" {
+		t.Errorf("invalid rest: %d", len(rest))
+	}
+}
+
+var benchScan scanner
+
+func BenchmarkSkipValue(b *testing.B) {
+	initBig()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		nextValue(jsonBig, &benchScan)
+	}
+	b.SetBytes(int64(len(jsonBig)))
+}
+
+func diff(t *testing.T, a, b []byte) {
+	for i := 0; ; i++ {
+		if i >= len(a) || i >= len(b) || a[i] != b[i] {
+			j := i - 10
+			if j < 0 {
+				j = 0
+			}
+			t.Errorf("diverge at %d: «%s» vs «%s»", i, trim(a[j:]), trim(b[j:]))
+			return
+		}
+	}
+}
+
+func trim(b []byte) []byte {
+	if len(b) > 20 {
+		return b[0:20]
+	}
+	return b
+}
+
+// Generate a random JSON object.
+
+var jsonBig []byte
+
+func initBig() {
+	n := 10000
+	if testing.Short() {
+		n = 100
+	}
+	b, err := Marshal(genValue(n))
+	if err != nil {
+		panic(err)
+	}
+	jsonBig = b
+}
+
+func genValue(n int) interface{} {
+	if n > 1 {
+		switch rand.Intn(2) {
+		case 0:
+			return genArray(n)
+		case 1:
+			return genMap(n)
+		}
+	}
+	switch rand.Intn(3) {
+	case 0:
+		return rand.Intn(2) == 0
+	case 1:
+		return rand.NormFloat64()
+	case 2:
+		return genString(30)
+	}
+	panic("unreachable")
+}
+
+func genString(stddev float64) string {
+	n := int(math.Abs(rand.NormFloat64()*stddev + stddev/2))
+	c := make([]rune, n)
+	for i := range c {
+		f := math.Abs(rand.NormFloat64()*64 + 32)
+		if f > 0x10ffff {
+			f = 0x10ffff
+		}
+		c[i] = rune(f)
+	}
+	return string(c)
+}
+
+func genArray(n int) []interface{} {
+	f := int(math.Abs(rand.NormFloat64()) * math.Min(10, float64(n/2)))
+	if f > n {
+		f = n
+	}
+	if f < 1 {
+		f = 1
+	}
+	x := make([]interface{}, f)
+	for i := range x {
+		x[i] = genValue(((i+1)*n)/f - (i*n)/f)
+	}
+	return x
+}
+
+func genMap(n int) map[string]interface{} {
+	f := int(math.Abs(rand.NormFloat64()) * math.Min(10, float64(n/2)))
+	if f > n {
+		f = n
+	}
+	if n > 0 && f == 0 {
+		f = 1
+	}
+	x := make(map[string]interface{})
+	for i := 0; i < f; i++ {
+		x[genString(10)] = genValue(((i+1)*n)/f - (i*n)/f)
+	}
+	return x
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/json/stream.go b/vendor/gopkg.in/square/go-jose.v2/json/stream.go
new file mode 100644
index 0000000..8ddcf4d
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/json/stream.go
@@ -0,0 +1,480 @@
+// Copyright 2010 The Go Authors.  All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package json
+
+import (
+	"bytes"
+	"errors"
+	"io"
+)
+
+// A Decoder reads and decodes JSON objects from an input stream.
+type Decoder struct {
+	r     io.Reader
+	buf   []byte
+	d     decodeState
+	scanp int // start of unread data in buf
+	scan  scanner
+	err   error
+
+	tokenState int
+	tokenStack []int
+}
+
+// NewDecoder returns a new decoder that reads from r.
+//
+// The decoder introduces its own buffering and may
+// read data from r beyond the JSON values requested.
+func NewDecoder(r io.Reader) *Decoder {
+	return &Decoder{r: r}
+}
+
+// UseNumber causes the Decoder to unmarshal a number into an interface{} as a
+// Number instead of as a float64.
+func (dec *Decoder) UseNumber() { dec.d.useNumber = true }
+
+// Decode reads the next JSON-encoded value from its
+// input and stores it in the value pointed to by v.
+//
+// See the documentation for Unmarshal for details about
+// the conversion of JSON into a Go value.
+func (dec *Decoder) Decode(v interface{}) error {
+	if dec.err != nil {
+		return dec.err
+	}
+
+	if err := dec.tokenPrepareForDecode(); err != nil {
+		return err
+	}
+
+	if !dec.tokenValueAllowed() {
+		return &SyntaxError{msg: "not at beginning of value"}
+	}
+
+	// Read whole value into buffer.
+	n, err := dec.readValue()
+	if err != nil {
+		return err
+	}
+	dec.d.init(dec.buf[dec.scanp : dec.scanp+n])
+	dec.scanp += n
+
+	// Don't save err from unmarshal into dec.err:
+	// the connection is still usable since we read a complete JSON
+	// object from it before the error happened.
+	err = dec.d.unmarshal(v)
+
+	// fixup token streaming state
+	dec.tokenValueEnd()
+
+	return err
+}
+
+// Buffered returns a reader of the data remaining in the Decoder's
+// buffer. The reader is valid until the next call to Decode.
+func (dec *Decoder) Buffered() io.Reader {
+	return bytes.NewReader(dec.buf[dec.scanp:])
+}
+
+// readValue reads a JSON value into dec.buf.
+// It returns the length of the encoding.
+func (dec *Decoder) readValue() (int, error) {
+	dec.scan.reset()
+
+	scanp := dec.scanp
+	var err error
+Input:
+	for {
+		// Look in the buffer for a new value.
+		for i, c := range dec.buf[scanp:] {
+			dec.scan.bytes++
+			v := dec.scan.step(&dec.scan, c)
+			if v == scanEnd {
+				scanp += i
+				break Input
+			}
+			// scanEnd is delayed one byte.
+			// We might block trying to get that byte from src,
+			// so instead invent a space byte.
+			if (v == scanEndObject || v == scanEndArray) && dec.scan.step(&dec.scan, ' ') == scanEnd {
+				scanp += i + 1
+				break Input
+			}
+			if v == scanError {
+				dec.err = dec.scan.err
+				return 0, dec.scan.err
+			}
+		}
+		scanp = len(dec.buf)
+
+		// Did the last read have an error?
+		// Delayed until now to allow buffer scan.
+		if err != nil {
+			if err == io.EOF {
+				if dec.scan.step(&dec.scan, ' ') == scanEnd {
+					break Input
+				}
+				if nonSpace(dec.buf) {
+					err = io.ErrUnexpectedEOF
+				}
+			}
+			dec.err = err
+			return 0, err
+		}
+
+		n := scanp - dec.scanp
+		err = dec.refill()
+		scanp = dec.scanp + n
+	}
+	return scanp - dec.scanp, nil
+}
+
+func (dec *Decoder) refill() error {
+	// Make room to read more into the buffer.
+	// First slide down data already consumed.
+	if dec.scanp > 0 {
+		n := copy(dec.buf, dec.buf[dec.scanp:])
+		dec.buf = dec.buf[:n]
+		dec.scanp = 0
+	}
+
+	// Grow buffer if not large enough.
+	const minRead = 512
+	if cap(dec.buf)-len(dec.buf) < minRead {
+		newBuf := make([]byte, len(dec.buf), 2*cap(dec.buf)+minRead)
+		copy(newBuf, dec.buf)
+		dec.buf = newBuf
+	}
+
+	// Read.  Delay error for next iteration (after scan).
+	n, err := dec.r.Read(dec.buf[len(dec.buf):cap(dec.buf)])
+	dec.buf = dec.buf[0 : len(dec.buf)+n]
+
+	return err
+}
+
+func nonSpace(b []byte) bool {
+	for _, c := range b {
+		if !isSpace(c) {
+			return true
+		}
+	}
+	return false
+}
+
+// An Encoder writes JSON objects to an output stream.
+type Encoder struct {
+	w   io.Writer
+	err error
+}
+
+// NewEncoder returns a new encoder that writes to w.
+func NewEncoder(w io.Writer) *Encoder {
+	return &Encoder{w: w}
+}
+
+// Encode writes the JSON encoding of v to the stream,
+// followed by a newline character.
+//
+// See the documentation for Marshal for details about the
+// conversion of Go values to JSON.
+func (enc *Encoder) Encode(v interface{}) error {
+	if enc.err != nil {
+		return enc.err
+	}
+	e := newEncodeState()
+	err := e.marshal(v)
+	if err != nil {
+		return err
+	}
+
+	// Terminate each value with a newline.
+	// This makes the output look a little nicer
+	// when debugging, and some kind of space
+	// is required if the encoded value was a number,
+	// so that the reader knows there aren't more
+	// digits coming.
+	e.WriteByte('\n')
+
+	if _, err = enc.w.Write(e.Bytes()); err != nil {
+		enc.err = err
+	}
+	encodeStatePool.Put(e)
+	return err
+}
+
+// RawMessage is a raw encoded JSON object.
+// It implements Marshaler and Unmarshaler and can
+// be used to delay JSON decoding or precompute a JSON encoding.
+type RawMessage []byte
+
+// MarshalJSON returns *m as the JSON encoding of m.
+func (m *RawMessage) MarshalJSON() ([]byte, error) {
+	return *m, nil
+}
+
+// UnmarshalJSON sets *m to a copy of data.
+func (m *RawMessage) UnmarshalJSON(data []byte) error {
+	if m == nil {
+		return errors.New("json.RawMessage: UnmarshalJSON on nil pointer")
+	}
+	*m = append((*m)[0:0], data...)
+	return nil
+}
+
+var _ Marshaler = (*RawMessage)(nil)
+var _ Unmarshaler = (*RawMessage)(nil)
+
+// A Token holds a value of one of these types:
+//
+//	Delim, for the four JSON delimiters [ ] { }
+//	bool, for JSON booleans
+//	float64, for JSON numbers
+//	Number, for JSON numbers
+//	string, for JSON string literals
+//	nil, for JSON null
+//
+type Token interface{}
+
+const (
+	tokenTopValue = iota
+	tokenArrayStart
+	tokenArrayValue
+	tokenArrayComma
+	tokenObjectStart
+	tokenObjectKey
+	tokenObjectColon
+	tokenObjectValue
+	tokenObjectComma
+)
+
+// advance tokenstate from a separator state to a value state
+func (dec *Decoder) tokenPrepareForDecode() error {
+	// Note: Not calling peek before switch, to avoid
+	// putting peek into the standard Decode path.
+	// peek is only called when using the Token API.
+	switch dec.tokenState {
+	case tokenArrayComma:
+		c, err := dec.peek()
+		if err != nil {
+			return err
+		}
+		if c != ',' {
+			return &SyntaxError{"expected comma after array element", 0}
+		}
+		dec.scanp++
+		dec.tokenState = tokenArrayValue
+	case tokenObjectColon:
+		c, err := dec.peek()
+		if err != nil {
+			return err
+		}
+		if c != ':' {
+			return &SyntaxError{"expected colon after object key", 0}
+		}
+		dec.scanp++
+		dec.tokenState = tokenObjectValue
+	}
+	return nil
+}
+
+func (dec *Decoder) tokenValueAllowed() bool {
+	switch dec.tokenState {
+	case tokenTopValue, tokenArrayStart, tokenArrayValue, tokenObjectValue:
+		return true
+	}
+	return false
+}
+
+func (dec *Decoder) tokenValueEnd() {
+	switch dec.tokenState {
+	case tokenArrayStart, tokenArrayValue:
+		dec.tokenState = tokenArrayComma
+	case tokenObjectValue:
+		dec.tokenState = tokenObjectComma
+	}
+}
+
+// A Delim is a JSON array or object delimiter, one of [ ] { or }.
+type Delim rune
+
+func (d Delim) String() string {
+	return string(d)
+}
+
+// Token returns the next JSON token in the input stream.
+// At the end of the input stream, Token returns nil, io.EOF.
+//
+// Token guarantees that the delimiters [ ] { } it returns are
+// properly nested and matched: if Token encounters an unexpected
+// delimiter in the input, it will return an error.
+//
+// The input stream consists of basic JSON values—bool, string,
+// number, and null—along with delimiters [ ] { } of type Delim
+// to mark the start and end of arrays and objects.
+// Commas and colons are elided.
+func (dec *Decoder) Token() (Token, error) {
+	for {
+		c, err := dec.peek()
+		if err != nil {
+			return nil, err
+		}
+		switch c {
+		case '[':
+			if !dec.tokenValueAllowed() {
+				return dec.tokenError(c)
+			}
+			dec.scanp++
+			dec.tokenStack = append(dec.tokenStack, dec.tokenState)
+			dec.tokenState = tokenArrayStart
+			return Delim('['), nil
+
+		case ']':
+			if dec.tokenState != tokenArrayStart && dec.tokenState != tokenArrayComma {
+				return dec.tokenError(c)
+			}
+			dec.scanp++
+			dec.tokenState = dec.tokenStack[len(dec.tokenStack)-1]
+			dec.tokenStack = dec.tokenStack[:len(dec.tokenStack)-1]
+			dec.tokenValueEnd()
+			return Delim(']'), nil
+
+		case '{':
+			if !dec.tokenValueAllowed() {
+				return dec.tokenError(c)
+			}
+			dec.scanp++
+			dec.tokenStack = append(dec.tokenStack, dec.tokenState)
+			dec.tokenState = tokenObjectStart
+			return Delim('{'), nil
+
+		case '}':
+			if dec.tokenState != tokenObjectStart && dec.tokenState != tokenObjectComma {
+				return dec.tokenError(c)
+			}
+			dec.scanp++
+			dec.tokenState = dec.tokenStack[len(dec.tokenStack)-1]
+			dec.tokenStack = dec.tokenStack[:len(dec.tokenStack)-1]
+			dec.tokenValueEnd()
+			return Delim('}'), nil
+
+		case ':':
+			if dec.tokenState != tokenObjectColon {
+				return dec.tokenError(c)
+			}
+			dec.scanp++
+			dec.tokenState = tokenObjectValue
+			continue
+
+		case ',':
+			if dec.tokenState == tokenArrayComma {
+				dec.scanp++
+				dec.tokenState = tokenArrayValue
+				continue
+			}
+			if dec.tokenState == tokenObjectComma {
+				dec.scanp++
+				dec.tokenState = tokenObjectKey
+				continue
+			}
+			return dec.tokenError(c)
+
+		case '"':
+			if dec.tokenState == tokenObjectStart || dec.tokenState == tokenObjectKey {
+				var x string
+				old := dec.tokenState
+				dec.tokenState = tokenTopValue
+				err := dec.Decode(&x)
+				dec.tokenState = old
+				if err != nil {
+					clearOffset(err)
+					return nil, err
+				}
+				dec.tokenState = tokenObjectColon
+				return x, nil
+			}
+			fallthrough
+
+		default:
+			if !dec.tokenValueAllowed() {
+				return dec.tokenError(c)
+			}
+			var x interface{}
+			if err := dec.Decode(&x); err != nil {
+				clearOffset(err)
+				return nil, err
+			}
+			return x, nil
+		}
+	}
+}
+
+func clearOffset(err error) {
+	if s, ok := err.(*SyntaxError); ok {
+		s.Offset = 0
+	}
+}
+
+func (dec *Decoder) tokenError(c byte) (Token, error) {
+	var context string
+	switch dec.tokenState {
+	case tokenTopValue:
+		context = " looking for beginning of value"
+	case tokenArrayStart, tokenArrayValue, tokenObjectValue:
+		context = " looking for beginning of value"
+	case tokenArrayComma:
+		context = " after array element"
+	case tokenObjectKey:
+		context = " looking for beginning of object key string"
+	case tokenObjectColon:
+		context = " after object key"
+	case tokenObjectComma:
+		context = " after object key:value pair"
+	}
+	return nil, &SyntaxError{"invalid character " + quoteChar(c) + " " + context, 0}
+}
+
+// More reports whether there is another element in the
+// current array or object being parsed.
+func (dec *Decoder) More() bool {
+	c, err := dec.peek()
+	return err == nil && c != ']' && c != '}'
+}
+
+func (dec *Decoder) peek() (byte, error) {
+	var err error
+	for {
+		for i := dec.scanp; i < len(dec.buf); i++ {
+			c := dec.buf[i]
+			if isSpace(c) {
+				continue
+			}
+			dec.scanp = i
+			return c, nil
+		}
+		// buffer has been scanned, now report any error
+		if err != nil {
+			return 0, err
+		}
+		err = dec.refill()
+	}
+}
+
+/*
+TODO
+
+// EncodeToken writes the given JSON token to the stream.
+// It returns an error if the delimiters [ ] { } are not properly used.
+//
+// EncodeToken does not call Flush, because usually it is part of
+// a larger operation such as Encode, and those will call Flush when finished.
+// Callers that create an Encoder and then invoke EncodeToken directly,
+// without using Encode, need to call Flush when finished to ensure that
+// the JSON is written to the underlying writer.
+func (e *Encoder) EncodeToken(t Token) error  {
+	...
+}
+
+*/
diff --git a/vendor/gopkg.in/square/go-jose.v2/json/stream_test.go b/vendor/gopkg.in/square/go-jose.v2/json/stream_test.go
new file mode 100644
index 0000000..eccf365
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/json/stream_test.go
@@ -0,0 +1,354 @@
+// Copyright 2010 The Go Authors.  All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package json
+
+import (
+	"bytes"
+	"io"
+	"io/ioutil"
+	"log"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"reflect"
+	"strings"
+	"testing"
+)
+
+// Test values for the stream test.
+// One of each JSON kind.
+var streamTest = []interface{}{
+	0.1,
+	"hello",
+	nil,
+	true,
+	false,
+	[]interface{}{"a", "b", "c"},
+	map[string]interface{}{"K": "Kelvin", "ß": "long s"},
+	3.14, // another value to make sure something can follow map
+}
+
+var streamEncoded = `0.1
+"hello"
+null
+true
+false
+["a","b","c"]
+{"ß":"long s","K":"Kelvin"}
+3.14
+`
+
+func TestEncoder(t *testing.T) {
+	for i := 0; i <= len(streamTest); i++ {
+		var buf bytes.Buffer
+		enc := NewEncoder(&buf)
+		for j, v := range streamTest[0:i] {
+			if err := enc.Encode(v); err != nil {
+				t.Fatalf("encode #%d: %v", j, err)
+			}
+		}
+		if have, want := buf.String(), nlines(streamEncoded, i); have != want {
+			t.Errorf("encoding %d items: mismatch", i)
+			diff(t, []byte(have), []byte(want))
+			break
+		}
+	}
+}
+
+func TestDecoder(t *testing.T) {
+	for i := 0; i <= len(streamTest); i++ {
+		// Use stream without newlines as input,
+		// just to stress the decoder even more.
+		// Our test input does not include back-to-back numbers.
+		// Otherwise stripping the newlines would
+		// merge two adjacent JSON values.
+		var buf bytes.Buffer
+		for _, c := range nlines(streamEncoded, i) {
+			if c != '\n' {
+				buf.WriteRune(c)
+			}
+		}
+		out := make([]interface{}, i)
+		dec := NewDecoder(&buf)
+		for j := range out {
+			if err := dec.Decode(&out[j]); err != nil {
+				t.Fatalf("decode #%d/%d: %v", j, i, err)
+			}
+		}
+		if !reflect.DeepEqual(out, streamTest[0:i]) {
+			t.Errorf("decoding %d items: mismatch", i)
+			for j := range out {
+				if !reflect.DeepEqual(out[j], streamTest[j]) {
+					t.Errorf("#%d: have %v want %v", j, out[j], streamTest[j])
+				}
+			}
+			break
+		}
+	}
+}
+
+func TestDecoderBuffered(t *testing.T) {
+	r := strings.NewReader(`{"Name": "Gopher"} extra `)
+	var m struct {
+		Name string
+	}
+	d := NewDecoder(r)
+	err := d.Decode(&m)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if m.Name != "Gopher" {
+		t.Errorf("Name = %q; want Gopher", m.Name)
+	}
+	rest, err := ioutil.ReadAll(d.Buffered())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if g, w := string(rest), " extra "; g != w {
+		t.Errorf("Remaining = %q; want %q", g, w)
+	}
+}
+
+func nlines(s string, n int) string {
+	if n <= 0 {
+		return ""
+	}
+	for i, c := range s {
+		if c == '\n' {
+			if n--; n == 0 {
+				return s[0 : i+1]
+			}
+		}
+	}
+	return s
+}
+
+func TestRawMessage(t *testing.T) {
+	// TODO(rsc): Should not need the * in *RawMessage
+	var data struct {
+		X  float64
+		Id *RawMessage
+		Y  float32
+	}
+	const raw = `["\u0056",null]`
+	const msg = `{"X":0.1,"Id":["\u0056",null],"Y":0.2}`
+	err := Unmarshal([]byte(msg), &data)
+	if err != nil {
+		t.Fatalf("Unmarshal: %v", err)
+	}
+	if string([]byte(*data.Id)) != raw {
+		t.Fatalf("Raw mismatch: have %#q want %#q", []byte(*data.Id), raw)
+	}
+	b, err := Marshal(&data)
+	if err != nil {
+		t.Fatalf("Marshal: %v", err)
+	}
+	if string(b) != msg {
+		t.Fatalf("Marshal: have %#q want %#q", b, msg)
+	}
+}
+
+func TestNullRawMessage(t *testing.T) {
+	// TODO(rsc): Should not need the * in *RawMessage
+	var data struct {
+		X  float64
+		Id *RawMessage
+		Y  float32
+	}
+	data.Id = new(RawMessage)
+	const msg = `{"X":0.1,"Id":null,"Y":0.2}`
+	err := Unmarshal([]byte(msg), &data)
+	if err != nil {
+		t.Fatalf("Unmarshal: %v", err)
+	}
+	if data.Id != nil {
+		t.Fatalf("Raw mismatch: have non-nil, want nil")
+	}
+	b, err := Marshal(&data)
+	if err != nil {
+		t.Fatalf("Marshal: %v", err)
+	}
+	if string(b) != msg {
+		t.Fatalf("Marshal: have %#q want %#q", b, msg)
+	}
+}
+
+var blockingTests = []string{
+	`{"x": 1}`,
+	`[1, 2, 3]`,
+}
+
+func TestBlocking(t *testing.T) {
+	for _, enc := range blockingTests {
+		r, w := net.Pipe()
+		go w.Write([]byte(enc))
+		var val interface{}
+
+		// If Decode reads beyond what w.Write writes above,
+		// it will block, and the test will deadlock.
+		if err := NewDecoder(r).Decode(&val); err != nil {
+			t.Errorf("decoding %s: %v", enc, err)
+		}
+		r.Close()
+		w.Close()
+	}
+}
+
+func BenchmarkEncoderEncode(b *testing.B) {
+	b.ReportAllocs()
+	type T struct {
+		X, Y string
+	}
+	v := &T{"foo", "bar"}
+	for i := 0; i < b.N; i++ {
+		if err := NewEncoder(ioutil.Discard).Encode(v); err != nil {
+			b.Fatal(err)
+		}
+	}
+}
+
+type tokenStreamCase struct {
+	json      string
+	expTokens []interface{}
+}
+
+type decodeThis struct {
+	v interface{}
+}
+
+var tokenStreamCases []tokenStreamCase = []tokenStreamCase{
+	// streaming token cases
+	{json: `10`, expTokens: []interface{}{float64(10)}},
+	{json: ` [10] `, expTokens: []interface{}{
+		Delim('['), float64(10), Delim(']')}},
+	{json: ` [false,10,"b"] `, expTokens: []interface{}{
+		Delim('['), false, float64(10), "b", Delim(']')}},
+	{json: `{ "a": 1 }`, expTokens: []interface{}{
+		Delim('{'), "a", float64(1), Delim('}')}},
+	{json: `{"a": 1, "b":"3"}`, expTokens: []interface{}{
+		Delim('{'), "a", float64(1), "b", "3", Delim('}')}},
+	{json: ` [{"a": 1},{"a": 2}] `, expTokens: []interface{}{
+		Delim('['),
+		Delim('{'), "a", float64(1), Delim('}'),
+		Delim('{'), "a", float64(2), Delim('}'),
+		Delim(']')}},
+	{json: `{"obj": {"a": 1}}`, expTokens: []interface{}{
+		Delim('{'), "obj", Delim('{'), "a", float64(1), Delim('}'),
+		Delim('}')}},
+	{json: `{"obj": [{"a": 1}]}`, expTokens: []interface{}{
+		Delim('{'), "obj", Delim('['),
+		Delim('{'), "a", float64(1), Delim('}'),
+		Delim(']'), Delim('}')}},
+
+	// streaming tokens with intermittent Decode()
+	{json: `{ "a": 1 }`, expTokens: []interface{}{
+		Delim('{'), "a",
+		decodeThis{float64(1)},
+		Delim('}')}},
+	{json: ` [ { "a" : 1 } ] `, expTokens: []interface{}{
+		Delim('['),
+		decodeThis{map[string]interface{}{"a": float64(1)}},
+		Delim(']')}},
+	{json: ` [{"a": 1},{"a": 2}] `, expTokens: []interface{}{
+		Delim('['),
+		decodeThis{map[string]interface{}{"a": float64(1)}},
+		decodeThis{map[string]interface{}{"a": float64(2)}},
+		Delim(']')}},
+	{json: `{ "obj" : [ { "a" : 1 } ] }`, expTokens: []interface{}{
+		Delim('{'), "obj", Delim('['),
+		decodeThis{map[string]interface{}{"a": float64(1)}},
+		Delim(']'), Delim('}')}},
+
+	{json: `{"obj": {"a": 1}}`, expTokens: []interface{}{
+		Delim('{'), "obj",
+		decodeThis{map[string]interface{}{"a": float64(1)}},
+		Delim('}')}},
+	{json: `{"obj": [{"a": 1}]}`, expTokens: []interface{}{
+		Delim('{'), "obj",
+		decodeThis{[]interface{}{
+			map[string]interface{}{"a": float64(1)},
+		}},
+		Delim('}')}},
+	{json: ` [{"a": 1} {"a": 2}] `, expTokens: []interface{}{
+		Delim('['),
+		decodeThis{map[string]interface{}{"a": float64(1)}},
+		decodeThis{&SyntaxError{"expected comma after array element", 0}},
+	}},
+	{json: `{ "a" 1 }`, expTokens: []interface{}{
+		Delim('{'), "a",
+		decodeThis{&SyntaxError{"expected colon after object key", 0}},
+	}},
+}
+
+func TestDecodeInStream(t *testing.T) {
+
+	for ci, tcase := range tokenStreamCases {
+
+		dec := NewDecoder(strings.NewReader(tcase.json))
+		for i, etk := range tcase.expTokens {
+
+			var tk interface{}
+			var err error
+
+			if dt, ok := etk.(decodeThis); ok {
+				etk = dt.v
+				err = dec.Decode(&tk)
+			} else {
+				tk, err = dec.Token()
+			}
+			if experr, ok := etk.(error); ok {
+				if err == nil || err.Error() != experr.Error() {
+					t.Errorf("case %v: Expected error %v in %q, but was %v", ci, experr, tcase.json, err)
+				}
+				break
+			} else if err == io.EOF {
+				t.Errorf("case %v: Unexpected EOF in %q", ci, tcase.json)
+				break
+			} else if err != nil {
+				t.Errorf("case %v: Unexpected error '%v' in %q", ci, err, tcase.json)
+				break
+			}
+			if !reflect.DeepEqual(tk, etk) {
+				t.Errorf(`case %v: %q @ %v expected %T(%v) was %T(%v)`, ci, tcase.json, i, etk, etk, tk, tk)
+				break
+			}
+		}
+	}
+
+}
+
+// Test from golang.org/issue/11893
+func TestHTTPDecoding(t *testing.T) {
+	const raw = `{ "foo": "bar" }`
+
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Write([]byte(raw))
+	}))
+	defer ts.Close()
+	res, err := http.Get(ts.URL)
+	if err != nil {
+		log.Fatalf("GET failed: %v", err)
+	}
+	defer res.Body.Close()
+
+	foo := struct {
+		Foo string `json:"foo"`
+	}{}
+
+	d := NewDecoder(res.Body)
+	err = d.Decode(&foo)
+	if err != nil {
+		t.Fatalf("Decode: %v", err)
+	}
+	if foo.Foo != "bar" {
+		t.Errorf("decoded %q; want \"bar\"", foo.Foo)
+	}
+
+	// make sure we get the EOF the second time
+	err = d.Decode(&foo)
+	if err != io.EOF {
+		t.Errorf("err = %v; want io.EOF", err)
+	}
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/json/tagkey_test.go b/vendor/gopkg.in/square/go-jose.v2/json/tagkey_test.go
new file mode 100644
index 0000000..85bb4ba
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/json/tagkey_test.go
@@ -0,0 +1,115 @@
+// Copyright 2011 The Go Authors.  All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package json
+
+import (
+	"testing"
+)
+
+type basicLatin2xTag struct {
+	V string `json:"$%-/"`
+}
+
+type basicLatin3xTag struct {
+	V string `json:"0123456789"`
+}
+
+type basicLatin4xTag struct {
+	V string `json:"ABCDEFGHIJKLMO"`
+}
+
+type basicLatin5xTag struct {
+	V string `json:"PQRSTUVWXYZ_"`
+}
+
+type basicLatin6xTag struct {
+	V string `json:"abcdefghijklmno"`
+}
+
+type basicLatin7xTag struct {
+	V string `json:"pqrstuvwxyz"`
+}
+
+type miscPlaneTag struct {
+	V string `json:"色�匂��"`
+}
+
+type percentSlashTag struct {
+	V string `json:"text/html%"` // https://golang.org/issue/2718
+}
+
+type punctuationTag struct {
+	V string `json:"!#$%&()*+-./:<=>?@[]^_{|}~"` // https://golang.org/issue/3546
+}
+
+type emptyTag struct {
+	W string
+}
+
+type misnamedTag struct {
+	X string `jsom:"Misnamed"`
+}
+
+type badFormatTag struct {
+	Y string `:"BadFormat"`
+}
+
+type badCodeTag struct {
+	Z string `json:" !\"#&'()*+,."`
+}
+
+type spaceTag struct {
+	Q string `json:"With space"`
+}
+
+type unicodeTag struct {
+	W string `json:"Ελλάδα"`
+}
+
+var structTagObjectKeyTests = []struct {
+	raw   interface{}
+	value string
+	key   string
+}{
+	{basicLatin2xTag{"2x"}, "2x", "$%-/"},
+	{basicLatin3xTag{"3x"}, "3x", "0123456789"},
+	{basicLatin4xTag{"4x"}, "4x", "ABCDEFGHIJKLMO"},
+	{basicLatin5xTag{"5x"}, "5x", "PQRSTUVWXYZ_"},
+	{basicLatin6xTag{"6x"}, "6x", "abcdefghijklmno"},
+	{basicLatin7xTag{"7x"}, "7x", "pqrstuvwxyz"},
+	{miscPlaneTag{"�������"}, "�������", "色�匂��"},
+	{emptyTag{"Pour Moi"}, "Pour Moi", "W"},
+	{misnamedTag{"Animal Kingdom"}, "Animal Kingdom", "X"},
+	{badFormatTag{"Orfevre"}, "Orfevre", "Y"},
+	{badCodeTag{"Reliable Man"}, "Reliable Man", "Z"},
+	{percentSlashTag{"brut"}, "brut", "text/html%"},
+	{punctuationTag{"Union Rags"}, "Union Rags", "!#$%&()*+-./:<=>?@[]^_{|}~"},
+	{spaceTag{"Perreddu"}, "Perreddu", "With space"},
+	{unicodeTag{"Loukanikos"}, "Loukanikos", "Ελλάδα"},
+}
+
+func TestStructTagObjectKey(t *testing.T) {
+	for _, tt := range structTagObjectKeyTests {
+		b, err := Marshal(tt.raw)
+		if err != nil {
+			t.Fatalf("Marshal(%#q) failed: %v", tt.raw, err)
+		}
+		var f interface{}
+		err = Unmarshal(b, &f)
+		if err != nil {
+			t.Fatalf("Unmarshal(%#q) failed: %v", b, err)
+		}
+		for i, v := range f.(map[string]interface{}) {
+			switch i {
+			case tt.key:
+				if s, ok := v.(string); !ok || s != tt.value {
+					t.Fatalf("Unexpected value: %#q, want %v", s, tt.value)
+				}
+			default:
+				t.Fatalf("Unexpected key: %#q, from %#q", i, b)
+			}
+		}
+	}
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/json/tags.go b/vendor/gopkg.in/square/go-jose.v2/json/tags.go
new file mode 100644
index 0000000..c38fd51
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/json/tags.go
@@ -0,0 +1,44 @@
+// Copyright 2011 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package json
+
+import (
+	"strings"
+)
+
+// tagOptions is the string following a comma in a struct field's "json"
+// tag, or the empty string. It does not include the leading comma.
+type tagOptions string
+
+// parseTag splits a struct field's json tag into its name and
+// comma-separated options.
+func parseTag(tag string) (string, tagOptions) {
+	if idx := strings.Index(tag, ","); idx != -1 {
+		return tag[:idx], tagOptions(tag[idx+1:])
+	}
+	return tag, tagOptions("")
+}
+
+// Contains reports whether a comma-separated list of options
+// contains a particular substr flag. substr must be surrounded by a
+// string boundary or commas.
+func (o tagOptions) Contains(optionName string) bool {
+	if len(o) == 0 {
+		return false
+	}
+	s := string(o)
+	for s != "" {
+		var next string
+		i := strings.Index(s, ",")
+		if i >= 0 {
+			s, next = s[:i], s[i+1:]
+		}
+		if s == optionName {
+			return true
+		}
+		s = next
+	}
+	return false
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/json/tags_test.go b/vendor/gopkg.in/square/go-jose.v2/json/tags_test.go
new file mode 100644
index 0000000..91fb188
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/json/tags_test.go
@@ -0,0 +1,28 @@
+// Copyright 2011 The Go Authors.  All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package json
+
+import (
+	"testing"
+)
+
+func TestTagParsing(t *testing.T) {
+	name, opts := parseTag("field,foobar,foo")
+	if name != "field" {
+		t.Fatalf("name = %q, want field", name)
+	}
+	for _, tt := range []struct {
+		opt  string
+		want bool
+	}{
+		{"foobar", true},
+		{"foo", true},
+		{"bar", false},
+	} {
+		if opts.Contains(tt.opt) != tt.want {
+			t.Errorf("Contains(%q) = %v", tt.opt, !tt.want)
+		}
+	}
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/json/testdata/code.json.gz b/vendor/gopkg.in/square/go-jose.v2/json/testdata/code.json.gz
new file mode 100644
index 0000000000000000000000000000000000000000..0e2895b53acb27b9486131d64420dc2ac422897b
GIT binary patch
literal 120432
zcmV(&K;ge1iwFQ3Rl!aG1MFSvZzDN!|6k_wSmFDz--6912(ky{aslo`5EyN#E%#Yc
z>sr!`eTVzsuh^0;RyWCh=;if}X3)DRX}W$a7K>HIBKh|(+bYk${Pg!Pt85AX{qiqg
zzJ7TwW}7cR{ogxnUIvJpY8s%fpXUK;{<03eVe=HA{vmtLAB#nP{ObR|ewi-rzvspL
zY5V0TGNE6;Y|GvBDTgoN|Chz;9_W-)#f%j~04aNEk@BqZvwwVj=Q(}KR;zq5@f&&t
zuH|xBuCB~<R!*<XahY#6**xFei0%D0-)yhUdy`k+^6Dl`?>A5R;@X<*v%ZDAw^g><
ztjp>;e4FpJjnDbVY?XZ<VJRc+WzrDEEF(uCKIsj}JMACWcq{YX%93vl35^*|wW5ak
z*0p+FZ$lH;cCiUir^Wiosqn7Yc9<$HDOFOE!_!ADJmi)MPPLT?IRT{H`pB)}(sDzF
z%nNK{xDeL7Km9J@zVtMsk~XB*#$dD&+9-@+l|sNLMlq(9qWdS+J_KJaw58Mt+9?K3
zjke5s5MWN8ZJt2K@286*U!}&jm`KHy*C{?4h13aJDh=;KLjbWLCV{4hnbU&#e`G|(
zEt6ae+0jXy2xd63B8aKS97`umaq9i?;25kk7CNm<M21)^jL}Ir-9pkBlizV_I4G^9
z1`&n(t#eX_VWli%lt`uPCyyz$)ItgPQJ0KhXcPEp0#28N*n~@=2{CU^6YaKskd(2;
zN?$_H`Rjc)hbUl~9%N*~xI#MZ%ZHE9XsW58)F1Qf>M@BxP{O1-K1BpUU&CjlgufIc
z=+@fH!<gr*yvnv<ZStg7LnjJ<WCV(a0ZRxq9uyeC2KtF&D7qeOzH_xmnH4c%nu1<P
zc6j<@hBOq^Fk*cGn!Dku&=9s(5smE1G=ssC7J?zt|0oZHOq+kgVZ_7ihix1DCEOQ6
zcT{RXyi)MPGX@|agdhM*+&8{nX4NLYo3D1z9d|GV-Ocic-TZD*&L`{FI4T+O)?kQI
zZmlN?pLCoE54477&^<zk22;w9Paeh5^pbp%hhtCka8&uUtY-J?s+_`XlLTWmL!XGp
z);6I`QE6dpqS5M<2xjv*mTu{A@R<Bh%=zsJ$V%?ir46XcvsoGl?Fpng{YHQYfQ#&y
z2c%mpEEZa{*?XiT`va}b{(A*p{gqi~i?rnip0UB%o;G}v&$OmBLMcus&ai_4qr{mp
zf~ILbVtN99h~sX3k;DdqC~#<s$Jg{&6!;UKu6(Qb4vl~z5!4p}C*bcvB;w0`kD*)H
zE)Hb<T)d3RZ}zmE{`8rcQQv6|Xy-8BgCVqHB*~3X$7f_joY2&1wHVb2tRVprHjU8n
zlnE_5+!{_4{0f{8j4W*)u7RM3QN9q2mjA@D(w)DxV2|(DWto=xyB~Xa_BRVb7{U+*
z?qtJsCJ@*O1Ol1~r37<Nlr=z;go2-e&^r8S@bHNwhBpv&^}C!fn9;nr(;t{(1Pnrj
zp(uONV+^vW-^My11e|JZmDN->^S9JYxHXc36QziIB8jUspTJbW3<SnRA^)&k=d1NR
zv<3#jcRFbUL7JaMiX}*(1y*T`A{#3OG@9XQN?6S~LxIKgIp2ns@^%l4VtNk<lK?@g
zgfS(={^{YfK0XM0KnHXeK2AaHQQ)&F=BsSGt5W_OolvEX)bNk@PaPAJhB?Mc)(Hd5
zj4?C>qepfimgwut9K3$6{XWW9bv8Snb@T?A=tgEDmYfbiF`9rIgfldtS4yDnKu~%_
zI*r*QmNDvyM=0nRC0pv7%%Fi!tBi%Qx_^pThQhk+mQ|!vC=kFy42Y6O#W$C%>FOP$
zC`3pGWLiIEOiMvpQjtz+fY-zb%H?@Ldh`v8_6-|>h8ZeB?R>Mh%J0`11jK#Du*<69
zR2GkqBZ$8(o^mXBkhTE`UZL<h<?C{pZ>wUOEf%l$M^)|+6~&<%@4})P*dQDp2$)18
zSnAGt$CB=`fiPgA7fl#24YF>LTpPv$0`w~DaLo)yp8+70m5LE;W+6DXpdc+<(ya|N
zo^ll(_9P61f_G%Qb)$!~9$jSWDHQOUEVsT;b{hz&)B2ziY$*qq3ArVJ!Yz0rwiH}#
zu+J^F-7UTZ@1y6_V*xA5KH%|40ZwUSwx<+iPKG(goJU6jO0H_bT~^Ldt{zFp<m!Qj
z@@CnrqkturF>6odKFMRcr{Q()b(L>69o8qBHfv8*KIzE$KnrpnIK)n2->@nYd?ik)
zTjHyq{u%~j9cCruMnWv(+>J)Bb~n(xx$-TC-e1Y+8*m7sDNdH>i+Q%p#${!C=cSGg
zO44UJ(AwzElN~!1#o5+b2198t{bEk$>`m@mt6&h~aYo;tu|?OAW`-b0n0U4Jz2|zF
zpvM5g5wC9u^%xxBPB2cJIMN;nlY%o#$o@G5Lda9*##IF%w~#%DDt6g(|H%;biIm_I
zQ@{2t;C?V`U4{n55Wup}dVJ5wp%)A=oebWH0;}`Q$t?&z=_rW<tvO3f1g<qSXBT)@
zEz2s<_ccA;`yyHgiJ*ZC1Q8ONznEs!3Y4z121W~ns7+|y+7R`~T8#H|sa6DwUTXqg
zAx?Ufvvlx!ex^MN;TyFdDyDM*3`f!t!-3Y)Ig1(Tvv+KdiQnQsu`1NI#q&uXhCK~c
znXJl{3xh$yUOFb-D}(9b23#CbUR6P}P}9#gGD6Xb0y75l><1hfq*;8W&eYUK22)J@
zf@7-D^rkvSU@$abZh6diIm+oKv^?R+>F}Fd(Ida>V8Nt{a)^OdA}b`sEOgk!8;i#b
zW8mU(Z;8$)9hYkkw1zN-O*1svR-fc8N9}1XYnu?M7$H)Zagf$;UbV>rT@BPkbJau$
z<t>c*ZAWFO(t>}kL<cH}bfppmCGwxA8~TmP?(~~s#6&zTyj*7#r^K&3CmhC)BDiLl
zYPZ~Dv4FZzh>69C0MQ`??!pa5u@DRgubTygkgi<8Ww`y@4+chRMHSM21;*ZaZo|f0
z+}UMGLHMYSg-l8?(2|z3E5N>by9|i$>@q$=>x7#emEY9;wvV9YdwfW0p~l&05gDcs
zDw1ZQK*$kS20}Tc3)5|CUae!m*mOgv<(8q;qgxs!5*JlULy5I`8hCu@k@Jl5ZMJpq
z>q0LgzFcVNZ@*r#ObR<u#wxkXrYWD}k>s^>Ps1F?oA~i;(^{3tss==RBzYTG_B70K
zeC6eMwmkyo0s0%^N-ac9Xv{ox>~4)`Z$muaNr<PTVV?I{uYIPMU|!p=>$9!5sNJZ^
z+v;}mF3KyhY`S0A<?&}5o#YakZMdKWEx^w5(5}dbMLA8U{34bEB7ee}5NO^zlDq}S
zJ#CmuUw~=38fPL;;5qA~#OGq$N@AbAIkm2gTh)<`PXZhGF{FX*Ktk9YZP2^`Zm{s4
zk(tRD?c!;kMgSAPpj<FIVB)_Df_`@M3f<8)#A!nwv6N$PX}FXls$-ijvzw~~K=?2{
zk_<MkA&ori*phH@832Nh(jECUZ7r^X-~$PxkF$4a1?`GaFE5Dl<5=*Qj->xp5PSqd
z^p5_>u{wSKj0FmmO2G|UqB)YhyzZVhCNR1blxE?zq|!~hho|;eN5qIB2_cIh8ZAmq
zXTe-{P48dOi*gTED?=qpB@$+oR1|3f5H**2P{t!39JZMHByY8TPisoxl%lnPoLgDY
z^UE<`EQ<BE2%RqX_EoanAGH<fnU$7m&KhlXo0f5Uk}1Zx4M6HXtz!^#CLxl?=Py{d
zup`N^#qntG2AF!J;}Y0`*63Y<dsmJSC9_(KfxEtlN|ac>uV18=G~Q@vtD`#&Ds2@n
z!FM?m0X+ulwV+(7l``1M)H)VzLczy=amIvD9Z*2Igyp1}Ej#P0y=B2-oiArpk<jYt
z+jpO;UpG$~4V3```Lnf?NfmA>eDT@ZDk%%M6~6dXZ4G;er#Na7W;rgAM|>oC(c_+m
zp^Ws<PGNb9XE=~=vKII}4cdM$AB*6j!G~`~F6Ig&h(RkeN0OfrsA+9Hr>r9nW8IkM
z&fcJE8uC_vdX5t!7{qw>(FVu`ZlCp}!6~L17vxOE*$%2W0Y(qQ5$TcuPmgpgggMXx
zg9)FLa`vWW!R5cRW)s?BzE3&^BL`Y@W$DHkdaO!b3PelE8f^3>1pYl@Y2Uv32zv2>
z`lP`nc978tjeXhXA!p`yJ~ps?Zl{#jAEVQ3vkgVvr=*J<7b;~F48?VWZ?q<uaen5B
zOi%D|hjQ-i;f`<8X7{l5yKcyqhs1G$)L4p2k37=R`8d#;RWX@6?7CQ{w?AE+`zhsK
zLm{*(6{9_U+M6ka+d{dTbgdO}rCUB5hDyp?o?YyCXQuE0IZs(|9-mfI9?AmL^!sc%
zQynSFemjobc{^I;(rl0Pz7Ft4Ln+%MlFjXb)F(10mmaQx<!n3UPL;=pP>yr$iyI82
z72pf>C$`M|LD_g=;ARy{_&Rbz&U~V@q846vc>1`Ixs*a#<7e{rhmc!*n};@(xQhW=
z1;^=w=%N_VnYTt#LJjSJV3g!cphMW45V{ut1&g6D9fFWBLlA-&A-Fp_N%?NyGOIRE
z$@3}Lgt&uMxFLt9pDmCbq6mS|Zj-nmZ4ljCwKzdY{P|5JkuVS-rxYy~GbIiDNDoWN
z@J3`7+oRd;5+9bgSIN2q7g{UfbfUd(r-%){lcnz%5R_Xwq`*Lex#OBJ5FB$)bY3Rv
z__i|<IGKVO%7x?z!qave+9vAAP8UL}3f)&>UF)#n%b%+}ofjeLlp`Y)fBXEgGN!eo
z{+-s2LeKT$uS5E?=cefPjTE)vcjFZg1Y(sAgxJ<{Y1}sI{WDfw6uS5#xK9?$0}S})
zsSm{}bfMu>9y;0^sOgQXG4rRu`zIPHoPq(lKfKHvkCteOP9+77J<h9%6i<iQDoXIF
z{xAs{CG5abr&z$$;^~t-E4!z)O3DmDAANR-E{ats{&wV%=fDX`h}38`Mr&6Zg{#{X
z6%-%l>3E)U0NrTDr!0^Lm>x-9E#ICtpq^}WYu5QP(4jz0Z|}tyV?^%^X`KlTUW(L$
zO03Vu-D8K(;Ln#mPB)CBNS}ZmM4{X+2!W3E=#f{7UlEc%j@&1C1A9+v4Qzool*g?3
zczI`=X;GL^#`N$_I=K{00J$6d81fpABrgH9r?v5nzAkex>)s}Mbdw&kO|C*K$ons@
zEZ{xU&m`Y@u?;FP(6208;P{yY`%tX1>NTXe^%v<@_FVacZ>>8#1)+N<`KjWXHhP8e
zG(LKwQ33<SNa#AZz@-ZT4@*l)ARNUPi0uzs4T$@1i{c?buFpg4f5;RHbR?~tf^r=1
zq+_6SpfwL+9C+H?DV%%N_MFh3hrbo;P{O~aCtV>CO|0Q#H-#4U87*E(I8_i+;W!I)
zMB+HBM$qGsM+}2T58Da=F~ShM^Pv72`2Oh1@bVit+~xgaRd(Ejd3h{79J8JVA&lXT
zgfKW7GK<^$9w$Lx9>~+~@o|}@(!ZBO(TYG36BRvxbKr1jX4Em8Se)DD5;h0KtrjB3
z|6%u7lp%BA=;_n{8?_BF)o*Pc3!et5EH`+?vWC#-`ihI-XoX-6y*ht$i%^ECNLnB^
zVJHO0cO?rYxj<=s2KcnaX&qvWyY1CK+@$+jYc{bcL~mX}j2YJ_ZgGnb+*6zhV$sfu
zRd&9{0#D6kjnd=E1XD)g!(@wXN5L?S<}rC1g4EV+A8FJ8C>Z-_`yw>Ehnm|n!!YjN
z7}}J?`3_kQ0+C!b7gDrz89Le+aHesLu!=gM{nQ+Q8b)w+<Lfq9?Fx41@l0iG<2Ui{
zL41Vm#I=|{z&_&s#dPD_`nU|<fL5ig@bx5c`QCooE<;x`<eO=>PG`P9j|~2@DOUj*
z%<|6Dzb}t%v#oa1<SZGR7Yr5PVxk+24V9eY^=9`on4n0DW#=M)bf0C2FF310Hu-Xf
zjvqZ#T8-aU1M{A73+i|(d?R@?(4OWe<=rjoSK-;*YTeMFSjk44OGtl|(BNaD^Ny-~
zp1*|F?)P8(PDVJWbg`O;CjY}XzY{s^wvQ$t1V_HHopTUA$_XX|k_w~S>uQ?=J@Hsp
z%VbcLI)7YBMvQMGJkl}#JJ1?fPC57d6uv!Y7`&;@z#r>hZ|0G_O?7)(Gm{hDL)Ut1
zs2NH#LKr$cx!SEFy*Yi#R+DM0eLQ|@h*Vlz;oo7$6r~CPA-$3o=5D0}U?xwAfG&PS
z0_9S3+R0T(Y6QN<akUFo#&8qdUH`gCRdz?$dD`$ilJ8m6wEpWy1K;aK(5^`R^EI%g
zFlQIsGFvRl>0~<QZ0ZxZ=F9kKyp;IFM55BAsEgNk$Wv<-no3r|YrG#*x2i==E6jHm
z-%{m~yr%AHJvXKgeXHjctTx$W$g=Lg7}Y{|7pK5j-bo&oJ*{^OhrJcA_e^H_I%+Q1
zgcubo2EtYLfz9TjOdw2QMxwgzhho0kg{r0YU!;pz<0tL_bE=H$!UHr;Y`~nI?aiLc
z0bWkHv~x49igjopolx`$f~JgNnC~RNFrlXT@k$M5)Y1K?G97<uz);Su6&DgUl;>&S
zUw6gGld9uot?sltgR9@(N&b+lX-zES#C#gh6Z&@`<FWmF5*s>+I{1P22K9z8p-~QH
zmOt!5CL>=w2B=QHvuqpMv_CKJsvI1jY+ID8JNLu8`E)9nxO*|`PKn74>W#j3p%e7u
zqq_yPmY3XMbAAyx8+DVKGz_6f1>luL-ZLBYLD~38+Q&sc4LKhWC!LTFSJdT=(Ju8P
z3Dsshng{4xw%Co#hY#f0)4x9Lt(r|Zam4|me)>#w=WcsutY~Z!<x~=h)-I;YS)lh+
zXcAcDFR3W>T3eSdzgJs@78b!&@3yJz)a7w4Zp*%0Z?lJ6Xn^PGuTy!+>**j@_|N$_
zw$ICT7WDbEDlUL{<YASruVMAW&Nq@DcGk4Mwr${B{cWeAN<Q$4KE&jF9X@pOZq^Ua
zXq{A(O-P5ByXllM)=JT=pXb9TL&Z6_hM-+bN0L_=x2K^5De!ziN4PZ8LNwaY_e_Yt
zB26Th4Smu|*_M`Sh3=Y1byymmsL*q=WSVh<_F68BP3V;O88r8y%&O2#`ai$?>%aZs
zmqg5}(I-}|shFik3;%>BC8VoV#KmJ=GfR~35k2gR#cW!xwpF>9tY2@9B(ElM-M9jX
zd70|1d0B(Jt(=P03_PvZ%&%{{I*8}|^|n&DU+xy$VqKNfe6uN5^CX&{dp<*GjwG-6
zc2Dyc%+~9U9=SM#Wmc>vxa#dn7@89ouB(k*t~<2r`>l45SEz{7u?*E10d>q0jfAPi
zYP7z8BpoNP1Ff%{^#R|?V^etht-;=*gb=Qq>l=|mgwTvz?j9ETCU?n)ac3!dOO&Zq
z%Qsr@lS&4^*q@qUdR)0M^9JoXe{*JK@J5`+N9eQSTYf(;lh!P;Vo4}RH#~bJf5oz<
zp?P()%@&JsTwM@Dn!f293CB9bVu#~yQNrV40rA{qy-IlF@%)^StiD6nWByL^nD1$R
zI;@!G<=tkLttWq3UzKxJmfMcmDqhZ`InmU}POcn60dy+(X8XFxC(})$hUEfWk6paW
zJ9;=CO9q&~lYHhit+o43;#!U9F*5-+p~2%0DzO%y?GoDP4Bm8bl-KlYb^mYv#ok+w
z8-|Xtw-<8zk@ole;kgLSnSUyG)ihLl^5^{F=ducY^D|7d^ZeH`p}MX(o-yN2A5zwG
z5#2$oTo{jccv|<@;*+{K#PtHLRxV1nb2otQ-z)g<ul2W+>3V%jjK3_`+t;5LMZVf@
zlG#{y`ybUxXd;ba^;IF^LfjS<pX6=B+|xWLo>caLZi1)P1-0Cd{Se)LI<N~`8CdwC
zvdmB-q?T00hUWOLhSBn0!SS`sLMHDpxc;<Tugfa*&)^5`E?X{dszX6cA3=={ulLxU
zz3n}0-u0S$@z&0_p~Zw-%HV7Nq0`dQ|JXi%H0$diB`2rf{@A&`)_yNmDNkmA#{9Wh
z{rt;~Iw+wvdssg#?kBXkpu1;t6K<`yKm3H>i`M3kq2ia}_V$;@#m%)g2<nH{enPGN
zYs8WcRN6n@#;7GU_K&x+{XbOp((XZM+vz^%FvP8W`FK_qF#RyHpHO3`PgS`rg4^vj
zRVXFa(v1IHu5U8|C$zQ3^uxwpwG-C6heZ)dqShVsks^$%WzKyjj_HN?Xry7TFys8e
zB1~eTqkG|-|K1mL{fLZzv&Q6iX0@(0&$f%~&=Oay9<I%%@A}rS*=xDm{%^k7hDKxL
z;;e1t=hF<J1?W}2saK;z{{{fxW%K;*?KgL;{H3dAq+f-jFM_004m4C{i9vldJa>;}
z^*yU*x5iavt690cJHVTui^Q%3rd6KN_?*4X|77pVnj1Hg^dDL>>OLNK+Uv0+W@5e5
z4(}raA|VMYir^4rcgw$ivp|Z>1gi=VTRhy|vI7q(HR?khd1uyR)vW8)%cx$=Uq<bY
zpN*Q$-F|680z>mUC8KbHno;>>Sx(pGY`p%GN$WfNa-9JEIy>yB_TD6ujeiVtyw1In
zQj8_HxV(wf$>3ZuWi>pE$b%4;3ofL=xxCAHu@3#<qWQdA8*-Ftymenh^MKdomuQvo
zy4h5tW?4+D#lz^nEY=&?(gP1&ssX#>-g3uqU6)fJJ9Q|aCdIVQ8cS}Y?STVhO`n=g
zCg<bwn6mkb?**r;+@!Rb(?4?>wJGlF#d>sK0E7En-`~GwAtdej!BR63ZoCz=Ifs?T
zd(KG_AkY{y<YLMcw(NqWj6yVK4~&+U?UeRDp9k7O%!aE#ZTKAd#of9tM)2wLa{ZQN
zVxsetQv0o7ngi>@A95faK4eG3Wot2H*+n`VsH1_pDv$ZA4TM`sfY_Lpv8uf4IVdGf
zJ+Ee?X+5u3qtDg)aa7EgkHxi@<Uihs@`_vfO1p=TjUzu;>(TjPV$9##P-o=D+Z2wk
zRyC;RG78*#S}*Ra2QbYRvvSpz9t_kxgt5sAb5iW)LmxO&hHb3_ZHsp4wbFSf$rTxI
zMBBeBZw_+4&f-jHyW=?6ooJYp6#X&G1%@HIpcwPm(Pl9AXsR{SqvzGbV#L_!4lLf=
z5hDEvZ$c*uFjWiFkCw%3F`AD6_WkHDi1S7?IVvKPQJJrpiXv3Z#@w*=pVfRGYxs1x
ziQYT_WX_C~H@4OQONGO8bErC#b!`>{h(voVZV8c6!rtJ@DJgDnLv@z#R$y_ajlMlt
zlquZYUcUiA+%PU~3lTkdw}6Ol?pr`aSM7!z3z9~L*txt?-_|%{?7UEh!Ef59#>3$L
zWf8+D>L)P*Xo5vd>_lLHvfWH=qv9s-!EloPB>D|R+{aO<&KVE88GFay-#OD0(7cq-
z;M*F9k2&Ls+t$qqo7RdDPZTk~P`vIsu~FU@54uRqr9bqO&k?v7jDAsat}s+C>h@!t
z*c$FnN4(tdT~0@KTV5|v`Xh+j&Fp>m&zlyDPenZ6FZ^OuhIS~UZRBfNtk>mgF>nrK
zT7jS{mGZJpvP3G?o`h7YE$s+;9^rr;bRL*Jc|mCf^VHe+5sg2;+4CbB|05cIgNxeL
z*OeweDa$P~N=#-5FO9bTI}0@2o=g8WLmxi^4L<@6-+@Q}RwExj0u4U`4e!2cH>5Lt
zTLFOcjq@(4Q8&TWek2~fE5ut&hPza1RM#$Y#4M8L-3_C-hxX%BwOnFDd$6}q07_=5
zGiXmjK(@5wegp6HUR<jh3(#Eb0}+sNR>kbhVl%7i(V`yht^z1$qjK?3Ee4m2@qvyy
z<+!qpquM!4+CzV(9k0!W#u1ruM1GvuQWz#RV+vQ9M>}(ULwi2nSNAXff%Ls*Y`Jz;
zvfYz}v3mAnG|DTDW6ok}^mXxmILmj%^l3C*70qK`oIf>13K+H^*BK(x0sD@Ysazmv
zhL(i9JF03Cf*ox#M-l7k`1JT(u14ECbl`9LW-Zm{;<!v0lMXCsM;m^T&ey&;*%ChT
z;@FfL=B0C{qdoVAP5a8`-<<>HT5SC1WBEJ|sQ$W~2!H5wvudhO<!DyUi<i-6IV;xX
zsF|+n`TQ%78AvW6Jh{OGk+6VkX+u$+$co;I=4k8Fus2T}gvc;ascw`6Q-O7(E3pmN
zRDYIm7OMGXHMAIRsIFs}<3@6FC+UHNCS^+-ctSAX@k5n6C}+ZX`S~E<+{3Oe^wG)d
z$G+;ld~ETRu-@a_NO0-tP>~=xS4{A)GBw_5#^0*?BPj;*s$9g>sy10-{JHq_{a8Q)
z6Fk0d7!DiJNu)m$#&5D4G2V1V7z<1uH^BJ4uIDiZ_tWNi`L8w!_V-m8YtfZS3jW{n
z?vJYc{7c<jyD>6G@{Kp^{PqSqy6Gjd)p{Ej!5I=BG!y2zZl9Q!ONY;p1V--}zJ%0C
z7y1-&3{M*tu2sj$l$kyP536GNSWTn3aOnf|GqBo!1fwvwX~mf1nZ~L9%1FlnX5Xhc
zkWAX*PYEOcw)>o)ighsng-9lHI||7QL;auD3FYY(f&g4P*h(EpTTb+Gn~tB6GM@7P
zWbV3g?F@Cm9ObSHsiali`S}p~p!H4+sMC0-;i=Hxgj@dlv<4wza*XSazG>F=GhU+}
z&ejo#iRNLkIYA_()o*FNdnU6?$%z3mDCoq*AZVq8m&C^VrC8nHZT|f8<5N}SMow8y
zk&zLJ$mu{!jhtPGOzn%vpIv3NRZ5bxtANv5kmpA(H+QJqfTv7q49A-=#v+UWB?5Rm
z`r>*CTHwnv#*P0Qe)T*2>SM8})?h94-Mjdg@ge*g4A<=inLVF$ek<%LYB;<ezz;!7
z|FZ7ejvy7K<<={=dy0gKqnTD5STX{teNaU;y<ryqPQunhK>xlIeFG7(E+TFdYy!qo
zoLPKAv^J7ys_bgm-PUQ$KVy@W;}&NEbYyLE9wyJcKHq&QqL)T=)~D}Eh|5gIC3eB|
zp?@|${QY~GjmM&T+VoGzFX7L=mpSQt`!#q(Pbjp5u<yQ~Z)a(yMYXC2oZs+g-^-k&
zuDk4V`0!`n(VPsLksfu9$Yq%<hK}L{l4pkE1e$V@OFYgr&S5_O863`_|Ge}n<!5&!
ze+YFoSu=hp1f`sWZ^aM}qyvN<?FhpA%)=W&9J!~s)ZBz$wokn9IzLR*rQ<E^1wkqr
z(|)E8yI=inRm~o<o|QNFGNL9se4PZS2-e3o(s@^`et#^V%U2{>QA_(0q{>#6V#ae%
z4QS;JGvtf_Y6s@6>xI<s&cN=kcHsC_4a5cf5LlV-#nsEav`o$y!FBBSOyJVWk`@bz
zCA>vY1Kf3?mq=n6)hWn~cE$`_#%pf+-|FRN`Ok8(8Mb~y17F(lz@adn0}0{T(mGsG
zjhVr2EIdk&%Ra_^Kn4lPJzk6E-?7}L46FS3KmVxK<<Hf;{P@zW%jdzTFzIr%VD?K!
z^OW`^l&7?%;eC{Vav2=m_ojMN+~#|^9&7JaaHX_QlCLd!es9IYLEeYpYj3*OhmRkF
zqx|P$T7Fzj|0w30K3C$qdokA$j)<{dM+JIAI`Q#1u`kz7b0^7?Y}+|ii<swU8(aF@
zyq-Rtc7je%0^0@H-zca~pDlpEJj@rFEg`+pip62|2=k0>0Ct+{*akZiu?+$(KO_B)
z<8&%0D4t9h!YcM8#45J5Aq#T_tEC%nWk~_tV=u%ur52nCFR@}y^Nc!;QDTg({l&jt
zPuR}17C(L4o`%bNG<Hc4<A;~n4SUhw4m~JZdcmy391M|=6}P1gPQ!cad!rwlxgqZT
zb*sB-F@sGU+vlHLY})J9Q@H}ozFMxs&JP-XpNA#MuE3V|+z`faAR(Q3OGBvtaKAS7
zyjYhrz%!raxKwU%$GGndz9W&r1Ffr8rDRb2t+7vPZQk>|6_=VVHpP6Dx{k75t{+zQ
zX1QzsR4itr1^j8*cWvTDjG_w-Bl%bvhAw);iugMvOl`0FeVYN+pXt?2bxE<{;9(Wa
z;5@XTMk?zFcL3u(NKl;Y@za0(_VMjU3%xuy-YX3!mZdJdPF;f+t`#1hE_MFYAi(nx
zPSIWcWp_XGHQ*d6Y6H*F>7O01?%OTSuZ#Qo7N+4+<0Q?dlc%>?#m+>>nSJG?xHp{8
zt02AnjPxIh?_?r6K}gwSDJ5%Mj>Q-v9RTcTgWG<_-W&Tc#l7{?ABpw6338cb6l0xa
z@n53~TxOK+jHYTd2HbC-w9FWH#*iCR5$T}2?PxTL0k%%OQQvG6Z{atspP#GHM70?&
zU(OHqul?SX-}fugqPMdBTMx$zovMMY|Kn14QO5N8yP}CDsH|7Tq6uo@qzUD))%s=9
ztig<(Y!+d=grc2kQr-7sZ<%vefg#gAalj5o>`Z8lrLg`jIS{N?Wa2_tKrlvn-6Zg3
zU<sCkWln)5jkV;W>?EwDR>`}dFx&MffD-UN_(7n)Xyzx=a<#7RtLeZsRAbE~80o<S
z6rLpJgJhCqt?QC;3=6(Qd529+31%z&c$0yZMI$v+62@tt7z;yF<Q((f2;YZ=D<in_
zIV>3~z=P0Git*QHqS9wD7+7}W@OqV>Cabz$Po~A>xm*{swvZ%!+F%2jM46Am3+1JD
zTq}%68KaEEo`1<<GjgTz<V;ud$$d2kAu(j<fchc`9ub$luqBuZJDvby!TCV|0d9B)
z&70W+%Fc_RI1*Qy494MXU_%KUne%-S7)`kzwm4jg<Rv0Vrs1)3a9(N0aBc)eE-Z9*
z5Fm0V<!V*0Ci5y+am&X}8l{YLug?^Vv)lpC5xk2<PzS3Ekq$<%G!1OlV&0TNB7uOq
zn-|lk7FMR2LvT5gNg|#*EXth(zG0|%lG?lWpWqTwudE=V{75`4nkIj)rNK=V6ZJ7M
z$;7-;fKreH1<Jm&qy<2js;V`6Gh0|#^5fz*n`FXDu`TvS_1{6(Q!!we(!h#iC^Fjy
z_JU>b&%D?^5eTf%XpmXbXqg8g9Je7isZSPVj?^&!T}&1s5@!7^4PSczo1>ggp30Xz
zi-D=3UC~pqczC}y0tcjESWr|zP?LSDK?+f}8`fugClxT7)u(Ej*I-x(=ZpOl&kR-@
zto5)<jmCJK_EtHHhbb=|xeF|UC%IB$44<PEh!U%;g>y<6j_=tz5j;UEad;Q@v(?3H
zaz8H~njY?#ZW#qbNifH)C!_C4NGNV;X!N34@X2Of&9j@N+oC_kN`!&;JA+|>;;orA
z^biOBPj2%$z{s59v!mFZn(1Q!@A_1(fYbKqPNAGF-l5a<93D_(y!VvpD<4WFSudj8
z9GxFf|2l={(%d?~eX4||rh^(_aDvBHxpSQ4*ubAy;QID>Rt70@bV8g<wKq*n$q^a{
zTn`j&tU`fI-mcBdWK}ksc^=TPD(ZF@8;{!!v?QwpJ<@^3X;;2uJekGfR7*%C<2W$D
zfP1h!8sQxneV)sl+VVN%n`Y+6FrqT})OsD;jp*PbL?EYx%-Z?S#WcT#C?c0K)FO)1
zF(Q~q8zRp<hv;che_pg2MbpmL+tVRrxcEwNP86yG3GJUPZ77;BR~JQ7-rt8lji1WN
zdOn*3Vl#eNma9y|vVqZ2AFdsB<Wea_LOW<n>%o+h5(6&{ZBq}V<~@LPXfVQvOFIS#
zbkHjzdX*Eyn6#ImXBqMObO|`e5<_?kB1#C_Bnr3&*kCFqwyuq0wF*4Bo`1?J7G|tn
zYJEuGSr^<sg4}TDLpLK$Ggv?q<;HYnD8e$xU)=>IQ`$uYl=2#6I5obNvCNWQB&}{9
z#Mi3)_a<D-n>Xy(n0J0sM;)|xP{t{uJqhVMTUsxotk32WkfI)n$#PXs%dA&GjBV2C
zNS5%(O(EdihuakC5{AAmoOnUg{*%ly+D-*pO6EsVfrd)eRtLr-sBLBts;r0h+^~Y<
zYhFK0%1`BDJqbN&`fb3(egf527(+5f5eez9TUuvs9_v9{n|Z^m1LXzIw^qptGZ(s_
zY0@Xn!7dhpcZ}iS=QZ8EeZZ3Q7858swT(?E7Q<F~0!U~qsJfhJQ7<M<xoE0ZvJQX+
z%4?cK;&{4Kp~RKM)7#=bZZzF7Ab^!-X%Ui{p^O%!^UT_{ZPh%5A`Aysq`G!S2-|I%
zt^XqL2TaA9K@5N}CB-L*gr!AG%K|vTck&hEgB3b?E}ttnG^dO!y;02K5)(u^jJu;n
z$35wLPaZcdc!pWxoiKt<9gYY)m0l~@mK}i1a&x3U5ZB%?WCINbINOF9Pl4@82-udE
z2i9i>gP@@Q4R*}JS#1lG=xl)u6Wrz<v%Qw^RY1+k`(iU+XHWO}fl-foF8ft?ep0(B
z0_8wLP_{IjJyFhs;t=L1Cjy2Sbb&d?Lm?Z6av&X`>}VuOv{{!RCF|+au*hnV+|uIz
z6I?*rAlvDU8WBudGA#r#JrkI&I!|QD21cMS3o0+X(`!b`TDaiS5qCihieb(OL(&A{
zSUtd+Jr;}Ee4sU&o({&O>g=0W5}uBh*6|Un$~GLcuAcj5Bzdfvl-4>TUJoQR{+5;-
z|0L;t^6;&GyY~kKQ}WUiu;cxU?Y%66H9P02Un0R!LL>roSd1&g^@3hY+%{fxGq74*
z)$$RhrP)*=@*W&)?|X^?igAwU7Knt<ZE3yeZWGiy@Zk5xGy%R-u0k%`Lw!wjn`L|Q
zL*@YN{8d>z=ap$6ya{aoGzkkBj216FZEpl-w>0!LnsAYyaXo-C%XfY}_tm`Y1;V>P
zFgL*Y1JW1)2i^DK2y%*s*AR|gCH|tbGFjG5^(Bi(OCfA%WVL%HCMP1tqi|%%0U^ma
zXw%%z_Py@Dg~h3+>&e$-iU$jo!)x9Ci8ZjE*aS+5K4{G#_qeqf=Hq(3Y=YRo>(P9e
z()7P{hv;r5b`;AiZTOU3d8Yc%W%Ir+x{Nt1_57=NU$3SiAldZK%TU*l7L04*@f{36
za#GO*J)p^u>XZSKP3oa&RC199gAtS^Jp5TL-;gTK$1LquCiWL-!XfDyAyVEe&m?UZ
z<E=54<kBNVX9Hp^FihHuVVhn=+E)M&@uoETWD5<zpyAsIhCK;k*wPXhPP&WX<dK`%
z^zls}-(8PnM}^pe>`4StCu_dl8INT#>k|uSM>4JJr>dMh*NY~<P2bST$g~MU1k8bS
z0JEcE-^p}2na-;aw%a+H=G9#r#>=0dL4FkBKn0UH?-#3Ndsx6}gr%`O;`_?47e&Hk
zvaiaqG8hB%N;_&-r^d!8z^NH1-Q+rtt*0~n(ec79##==UpPKe-V+DS};v<Wc&zTo$
ztQ_~+hptjuN}?Z=)J3N_{NGn(=2W;#^*H<Z2vU;CXgF7)KOaaH=AE&ml?g6*Ff1Tf
zwhxih?Nw4)L<2aF9*2zQcmS4@V2)-^a9Z~!TDC{@W-mh(wC+X%cK*^qi#Pbx2kpxn
zf!h>e(xFggN6XIDvaWMUMS3g^7+Rrh#aJ&GUOz#~;35f@k<tU$_|j;S4swiV@?0#6
zhrX&W(D@v^4W>RAxP)Dkh)D>iSV=PX95YS}-Z_@s8<M#<G_SynnO95*qjt|!&OZv>
z@1cO4@RF0ZKwb$ANb>8}Yq@ulK2w@{<lLcBmV?7b8^>to{V}HAJk%>-3U?&|^<B<g
ztj6aU*PfQe)hvqTHVQpRfd&mcWC7dPXDS&2_Kp?ZG-qkGqj~XyJF86BcRe6OM2=x~
zjDsz^eexvVjO_I&l5nl2>8>H=o5M6oOJ^uqlXO6l0k)?diRno|(w~cIi~~DLgnVGZ
zj3D!5vU@$6M(1?sOW}16PA;uEwAehL5h-Rl6peCDfzs6p{<QflV7h}ASuDU>g#iF!
zj*W{ktiA|M#JvSZNUny&jm|t{9t1H~C_V5_=4jtp4}ax7sXC<l8o;eHUUCu>64~7h
zJGV8kJJnhs1f|b%q@3^9()yrO$$7g<hD1zbXaawPmFiZ%q*f{C_MwY}1)S+wC1yBa
z>&y~p6PjeJC2?h$V(3urIoBZJL(5^2*gVd`mQYp@SV{v@*;zaV$HWbSl}n+csCZ%#
z2czOa#c_FsDRlQ3n7sh3z&r25K_LrC(z4;qGvR#~oa#tmm~#h)*HQjUS1Xv@7t?jU
zdg%$sB4luglHDJUlQW~(V4FEcLR1vjE2f--ge4*QQxI_<D*p%1)@>mRS$ns!j&Uny
zptp^h4I*^{j?IQRIu|YrAsjzr&twxKE{p3{R}$~CYwrJJ|JYmh*mX`oHbUX72bp9{
zhy*f|_IDiF@o`KxY(!_WGd9el=*fSH{t94L1FmhB<Do_&7(29+yfv0PL)7*Ru3UVH
z!Xl*t<UAfg<Z!*xvbg$e`fFjj>NLe&A34^Lu3zdgbwUh~J9;?-(7<YPd1Jn(sPs&T
zI$kI{=1PZnD)6$7@xbZD(?`l(+|}B~*fhyWSj}JS$Rgfq^xH`Y<4*pszRR}C2qg(B
z)MRa+DK;5yNMN+GJ^Tv^td+W88Q5OLH9R;cU~r3|!?+nJd)f(c?eil+%XCU`5LtA2
zBX3KK4;<1Y+k0KJi{h2H2dk4@6h!R1p(>Gc+_FAIxhYX#A%Za0LbGs5yi8~vk(7hD
z^<*WSxx@h*l=yvqtq~(ym9uJ9PS@?hKH-Lg<AaPzDB)mBOQ3+khbYuTC6g4!GKu>z
zVA3I0xubQt?l^=;bnw`V&}IkgdO~K0i83+RqAdfbHI})CzHY2S42x;cgba;Kuv49U
zsPVA2G-?z>AmI-s(KbU4T0A-#p`ykMu|~AB>Y-ZH>tZ!oK2`Ona`jkNv&n-PFU#i)
zD@b+@LcJFEUlnP;_)5cHwMVk+e05C-(-)8nSH^%A<eD&cWmC<BgN=8UDcLOQroIOy
zX488A#<Ozu_KqQ3YhYuBXe|d48h%TQuSk3QL}<$P|Lnc*a^p6#K71?Z0?w!i0wlnX
z$z(RksbrIr$?n$qq@pESW=xS<lCsBB_1^p2O;Qp-0wBk+1Z00>d$k$J79KVl{SS?9
z5QotWAr@CTJQo8!<I>d!9meELnyT6r+4>C6HJ;x-eDmGUA6z0R^X_1w&FVcicWyH~
ztC)E;=q!4<va~#;l$XJ=5d_<;2DOJD6|i7D<7r5qu^XGzT?gO5lw%m#r_pZ0pex_S
zZ#B(@eotw!tMhWJQB|dM^w_L+-9a0AdX_qx=1W~7LT^WQe=kGQouYnhVLkFc_o>uI
z+}JvezQQr)lZsGncbV7Q^&zd>7ae`IT{`tv1&mU#(9IXs<5j{!tm1<itx>3)kcV@r
zPnv`t(N#|ymsGG-S_}iq5;UoTE)_^Qf1U#{&E5$)CaG{XI$P;eQ7k8Q9PIoMJ}ii1
zSPWz8?=lP`hF_w|=sY#wAFPBR9QY~1geagyptP3|a~P0>YVIO<fH9?X6o6^EUZIv_
zE*fEF4m|S)FO(<;T{DExr7dAgtso3Xgh-F=gKaSw$7auX?;j`<m<nWTF^Gi5F&&j(
z!T*gf_R-FZHZMkiRkbm28WJ$<g{kWNLJXV--6{KMS8Ov&HM4|MPO-o!4Y3lb$&1$_
z0H2A(>Pi4jSukdY87CS0IEIX}h@jiPcu$~@9EU_L+rSwWBpI^;#moXL2;f85POuOn
zzzD+fovB3;11I3UQ58j2+ha>3LM&%UJtat#ut3c(JY_Z6wuLa~;44LVfYebG%HdFL
zK_D!MOq2laefdPvnAtEGRjOvv%aBw}rXL##CA>#tn>CIx@d^X50_Z8o;>{SwJc0*T
z3{s#3USSJI=R$PXKG;DJBMAF`G=Yd1Bcrm~S&7ZiZ4vP}fmMqzazeS%=^>oK5Yq?~
zH53e>_}N4{HzihTwgiY`1%oi1Jn2A03Cg7r2oeVY8LdW_a5U3v?)oTbw%Ir*MV&om
zY2h4()r!0YhP!IJ)3xFObGXh*`z_^wn9&hCI%((<X&uI7bVYi|-9p%9C0>2CuF};(
zbh13dGF6-X!7Y@`dboJ~`N2bem^tCRJ_zK9%&OOJhQR?Hrk31!2127zS^qbA*5|yW
zA=;B}cVW{Pnsv(l;N^8;VAqsr>vYDVxjKq7S2&dghdRqj$MOi>-r6-s?2m2s$t_2e
zRhu=okm!v_u}f#%o*OQRQ^o{y#S3ZWTz6DWxONT#L{*XBxy1lBOaA0oahw*zwangT
z_m1Ud(>!LW^W9libJ3Bjqd1oNC-)ol=kzhd8dNSZ?9(#8$4sw%>BWLLcW}aB#Uc`r
z06Wb@gekQhXk?woaGJ-Nh?D{thqUcJPm{rPx2e-|TkZ3wRrgz#vkmjbVdZ!l`}QTu
zol^};N&@UYr}X+s4~ODqfVygIW#gilvpAq+c-4oN<s%h45`tAvm0M>ieA>3ZMQJAr
zPl$;qO1q)U`O*an4e^G83I!kwK8nrM*m3g{R<8p0a0U+z%q8`tke+<{XfLY}g&|k!
zA#L+5R(@?BK$u|1s(m(xX=zu<%UPs+MjFs)v|NBZRuyiIX*%n>>R4{OET(1-((>vP
zX8=}A!<d|Fk=0FJm7oBh=fNyXnZJZwZHI=yJ_6_{AD#9I{M`xe9F#@<P;@&>1LZuX
zBzS&m`*VUBBrGxZ52UXkN{|4zD}3DT@kPvHX=Ny{4;L}PJmVQCAP9h0lzZFNroofM
zLy?!e+07J;z71%kLrg20B*IfI`H=gNWi`^J>tpDgVd|{Rc2%=!X7$t6p<E7pXOI}H
zE%QhOEL7TeT!y3_+>gnpyx7TM+1#TVnWk&?JfI?sW=}kM2p<^HNhUbQa&SpFys9Pq
zXZEMIq)>pZu$0mmea7Qz^H76vax^Ai(iKH(gHy)3SL0<r>G5pV0G7rfVqB2MmXv;t
z19q&QWS#Qr2ipVr`#e~)DHc%*e~U>XK@w0kHa~ZSs4K||C}^0B3zN|ho8W~UYrZPx
z@m!9T&OFAQfyr(+m_of0r7^#|t7BkA9l%n^=4vmQB^nK*I8my+T!tix){l))t;?)^
zuIk6WMrzuXbGLw?E9|w(<0K*?h-s{rqLW1o*4ON7m8!5tl{*BBQ3Wl5wXEs`R_0&{
zOicrDL=@4a<mBOMCZW>ZU01b7&^QP}KEB^}s^dJ|-(F*);LIgJds1{j@otR*<~$^&
zDEDIqFsG|-_Ld$d^Fd8WIyYK5r$sRiJ7j!`DoWxgoZ!*%l+9}qc=0ocBkbDExy<OJ
z4q+r_bgm7b0G1Nrl+i~-a@nbHn>UZ^&I0YqnQYe!OHy?`&gDLL2KBD#S(adah6q&N
z7I-g;#><ge>vmDt+Jce<#3=8&!RW6r>ac;d1XDq^f*1%FF<C|M9zMNzToOYk9F}#T
zz<R_IG-28W9P6OVRT>SI6a=HNV@zAKNMBr6=}_>1ecRYok26T_iPUY#nR<g9K8$hL
zf&uM(8AHvBr9h}iLQcj&&bG>3wS8G{Yj6=4*M7e3;&uGJ3|XYs3yDoe>|$gQ$E0QZ
z&hvm&Jy&_c-3#qc3?~Mhh$LcQp-@v8T4yUrf>Vx`1u>7urutIDWnr}o9T;5;(OATR
z#&E&N-MQTshC|wXaWe{Y=O+<|RPB#=8Itc)bz^o&ZGjC<>NdSA>{2QmUBfcfAe{OR
zo$nO{OmVa#to6v1o~sjdRy)tw7)uA>G9+E!@5koJGuuM)W>9>Aag%i!*{CsyG!lb1
zmr#LCN|ms(Y(VRr!>LaVwk$eD%Eh(LKGnGTz1`Yu>ip2I?=w8*s(Y_-SwmK$Scfuj
zdl4|L)145!Gd9ZJFyMPtXE}LR3y|~J9FS#YaTCgojcTVVN?_p<@L5z5j5;D52cUu#
zS5=`g(4{TGtyzG8Ff5-sIt9?D%CGS)%afZb$;Kq=8b-@lC<EpfY8^2!egg2B|G(>e
zs&qvb+%(-GbhpT+@xj$|VlUm^9_sF2cLkv}^timaI=om!g~<w;l=tt4I2koEhcS>M
zlc#^H&y|7=eV^X$q-hP0mEY?mr{=d_slzbzK*K<3F@G77q<TN5S^qcsU}?dNEpRye
z#!<KVrFU)T0mgbi0?TqUd1a)bGpy6t!mIdy@>5s16->J*vd^R4MT~_3n1S+%&0(u!
zBphB=L;OEWplC=jv<g^1WW`~&`GhG(JSo866$OuCq6YGk2plg;N1*0g8Jn8J3Os+H
zi6U=eEY%&Uu1kmqobkBM22&r1+do+QKyfUvK)TFuL!*N(?5E>A`F*<$qqJ&aN+~b3
z=fI?%s@}h4l*6x1IPY5XNN3hXt`liEyuPo~xu(q~QQLXQQLI*uJP%z?5{I!7pao$@
zvI@9bPRHb=#sch3xyTsy*&#HJ6rm3r9Da3DR)(x1^EA{xjqZUXk&sabobNvT`teIu
z2KYT;5G(5~4av!j-I(^|K(_(fw0)aC$FFY#CLL{n%)9@hW_9wqhcOFds&HU8B-DZ;
z-59XLWb0A&Ik{ooHPh%Gl)}G*h>UkQ4LBwzf{zy@*v~6gq^WYMt?_jYHBtq*&2mV%
zOU}?O_g!5*H+ma(+KKaksdBSz;zlhnjR|3sdX!z|KkUV%_+K3C(?B_*2fq`Oqje6-
z@YcLLY=~!d5aO;hiw#vb2Eb%g)&2dt1&*z=O@;M^ZjHn&HQwg=to&fhbGkM=)LBy<
z>y4Hluv%7E3aw1F4($W@Y3rvvdtUv~e4zlQB%%zv`pAecLl;sGV{)7gW}TT7Bi4~p
zD%6xd$P+BLp@cEerDsZ66s$swNmnx6@^XvU!rFb|5X2r+7oC!!L$GNq5SA8gonnxO
zBo^++CT0f5>Qt9+lU1#GR2|<15ygBRrF}+kQZ;Y#xG)`T=Y%UHzYJY)3}ZSRwuQeT
z4Er9qK9KaTI<{EV0aFl)ygb^sB?X^AfN+k&gb~7HX7c+YtguCumbnogWyM4_NJBxv
zXprrN4#d0WP^8VnyWV)PLNaA1G3=w(p9P&wBf)|&qRN)Q4nv9B=UPT!pL%SN%G6Mz
z6cHv*Dw&O1EHt74SWu(wnXEz@3oJ|=Vi-d)29<OB=`_0S8OBj0V)aC9u*KHBM6#5q
z=ivH+UgUAyy_!;b!5<W1*Bn-ga0BZxp?2g7@m7<v{0b6l=k+CxtFiMP<uqh=ATS2p
z%#=c+Cm?4XzuMJX3my{F1WTGFf=6L!lAxL;((F_q9r$iUDP?ucHAcj9cBdWh_YJ_i
zTOad9y=`tM^8k@YNdA1q^gjVau@UF!VoMA?n;TXOWEh(|n+fNk^ljQpnrU>;8If3U
zrE~0QFXd%E)BMI<3Qw^^1WiDfC_NVvtgT5@b0-NSyqjr4VsjnLK*Bj7825_RlRPX<
zNaJyAH(UiEBa_Rwp`5Q~8a?Gn9EKAP(?wdaE&Vp{Qdd$?{KE<AYhrC(WFbkETY}P%
z#1;M6Br>r6!ln~kZ8~9WCZ%gS5ynLD(XFo-FYYGOh=mrHH3m*VcXMoEEJPG3xY#Rj
zfr^SF9j@1P77bRhTKzjV*iEoTV2C91{Y<)|w(QIB*>2E{ij$iT=?(ZmgNqTqD2l`6
zi|{SdlwJXKOVFw;v;Niv21=bLEOw2ks`5VHoth?`8lwOSvCxIJ<58@Bn+~!GQbFn2
zBHe?ypd(2T60U@nVL5k2b(hXG-(FUwU(R*2roRniqo`H!lnq((`v9ImVZUZ~I^na~
zLh#7o-^3AK<$`~h0@75VO)q3-VtwgwMY=JPkVGwFjpFt`|AcuwhneF>)0s18So=*5
zhD$@2VE8aLQpV9L36lu4N(^o-A&FuI#nx$b3J-6IVS@zO%L0OfAJMFvyxbL83)`mm
zxNTY`qCAj(3}gq7g3zwFuGJs{r;YGLgc@5|XC?G+p$7!AW+rLV#HKn6=`ti)Nd4Fp
z*?D^FQT!XtzVv|c^-r~}_G_)n_C>zHwc>(OY!a{YJmpQ^X4`X`?5mQ9L6{4ob~?Na
z$#z&bHeG_zqZ-qvC(~%3G{lDQN+L*`-u3of+3I$I{I=aL5M93Z>DHAoE(NL~3P(T*
zC|gEV@sUJ?DvhrcB-YaE%JnZ|Qe`?MXqk3}&?O{9P$2?UgOpnk)Oe6^GL6^!tUTHk
zo8X26C$QvEe=0rnK((`&u+hz5#GzFDN7E=rF_9K)EJwQDW^I}m_LaiBWd?4QrnMnC
zjV(c9Ep~kcAZ7ZL@6ygH15TL>``iS<tw|vBXLm30WCkuv5yk|(gb=J+5a6jeH2{<>
z8>_K1j7b17Fn8L@3qdin0VazV8U~S|WDXNez@iS6gL+xK0P_~v4jVYxmTnXyF_UQ`
zXQUyCO#PS%Qg>|W7o7F3eYCHdBTP=oWYP{Z_ggGxJy_#Z&YP8nWV5~-Gtp*=YrizV
zNOPVe4P77&W2TM2h=oEM2BM_?NJA<HqU5+uFxXkx2w*B{q@fFdVax!)?sQ&t>Yo0y
zO~!8p!Z9Hn&VL*FPfoIlNO&Am-1JeP7$Kp38lAl!QE*PcSDDB`kc4Q0XgrJ4$>MsO
zH+@ON{#WfMB&xln78je?OG!vsKq57=9L0<h#-|dy0XOfi`qZ0DbD;^g;z1NKa19u^
zRMgzxjj@1Jp|o+w7F<y>zNZ=Cy*uSBINdzv<!;^i|7#l<zGBoA+*VEny5<0C)QmF@
ztEbdZ0nFe$QUwe){l#h*U$k1pxL6UeUz{k3@tlTHn5a3lF?K&rlsxibv7YnoE^FtL
z^ZVL#oP#$RhWM(~!c+oVG$53UxribK$219)wB7;IrcRs71<plWL{@P?63kGD`&VId
zn?rEsSuCgYMl1p4rp8?{2tbn&xM7>^v!($rV11t#bFu0K_!F3xpI!~u+-QX5(*lKJ
zu(g24)I8%5<Jn3u_>x`FQSKBOoMEVFC6XirZ5{|NBC7U@QoVpE7J+h00az;n9#ivz
z6A%XARxA<))<*EL814wbYAS^#m|YS?1aDKQ$qx)fT)>s&2h$o_FvY+Hu+wRjfNbK*
zK1}ROsP~r=BGfi}x}~$}P^?7&%f>;QaAaqb1GfwixP!1+m8eX5+~(C<(K@dET%(F}
zdeopJlv6+>kv@Zma1mm4P*^+>nCf6@gt?ZlyY`2pHB*BpGl$+xNtG}$wGPeHnWQ{{
zXNs(7td%xYFs2jFrDz1`J{sz>)4p);!(<dhBZq|x)yOcn3vI^mhMIau7GQyeBQz#~
zN&kWYb+i|q3yeWHjoy`pBo)_>eSuM6-Er4|qg5d@{&%>FQCedm^8VGdcAQ}=awS?q
zV4VmFRH+TZT?qT$UlJFfD`L#%P;g;+FQSG6gNTh2lqhf>kAm?jv5sEY`D}0La}S~k
zIQ{Z!I<X93Cv+B!1PnZhMD5khU<0BCUjS^*k-s{yeYJV~QpwQilqBX@*$!TfQQfIg
z&}kbkRM7xNv|zEuwNt$XYoT#fh8h!Dv4}s7<c&z<P=Ix+>K71Tk?IyJUY#}5D?lGC
zI=`BdtEVgu?3{px90lVDY~h63)vi653pSvH$8?`aN1BV<DUk;FN7xoikp(urrzVUT
z@;CK_(&6Hi1bhju+1ME!-Cs4vGACZS7TGXn3=zx(m{*v*9w%6xw|_NSD+J5AhO>kU
z@$$IFd(slhrthv!Clj!_K9)CLz(dvK_HY4s<dRSj#w`ertx)nF^eZTsh?UA^UD<&z
zFoADRqfeU|TP{+?rs-<BPN!(`fPWAx<$Lus@`sJA<QdBVqc=xER7Q-?vJjSj))~Iz
zy*AhNIyMkU72yk23w)Er5;ar=fX$q9BAOP}@QzeI{}R(l3oPV<DVL&*_MBBdh02$y
zWQG=12$q)`{zapOa%#<OSaMWvT(zkuEDg!^1G=%9=$F;{rksE*66aSFVWv(n3<=(s
zT#-(7BJfw@@u?1j{f&(xs0gA&fQ2mkMPg<i-C+r4N$^CGetETSAL<Mna@(GFRA){p
zilfVLo~GF2MY34U%ImLd-WTc4c4%gj9s)0Ib|*FRyg|a%IxSewCQy4#9I7JUXzOle
zQkwN1%Wb112Hu#jJ`k7`6Bg&kvTzE_uI0wKJYK*Fon{Qa*#}Fxs4wM4^YmSpqD@t3
z-on3F_g#!^MY&ciP>RDEYwcr!A*Qwofn^JmWRyio6TC$#LC?xf{c`Av)OK(dE{K}K
znItTb>om$k(&YV^%r|M%JY!9Y=8$dj`+U<l0MR}GXF5f2S5=Su6sv{1B*V)g+jh5_
zT%yQ6wOQHab-P4?*FiE+VH>x6ksezt)#7$V(!;^&{HHvBrx-w5yV#Ow<IYU09`eqp
z1nsmmh`FK?%6wPVxdVbv$|rC|`I$`k*DF7);b_v^cgOpsO$khoufcU0k`r#au`ehU
z`lmiPT(R)lbZxTwKFhXf?3w7RvlgqpgI%_%_IoGR&pyR&nzt9|Wm&ad`n?NL+F!tQ
zX<4{<=)O+P?I(WD?i@*P^t65dV4c%$E%@<vwc(}2!93lSRnvl^)rrK*yX$?m%@&pV
zH&va4*+mo)rNlH0@sN)}qD+s*dgF~g_44QsImTmkaf9KVo7^ar%)Bx`9I}P+MRRG-
zSYXntJUuGeAXf8PY1gn+am7C!@;X}&&wh%O*lmx|b#T+!9)e<t(l%C?yUD_cakbi&
z9@N4RtSL+_A_jP5G+1F^T<yJ!!E^O8CSDdfr`itJw#<9h4uNyJ00PI5?Hq)KmZE`U
zH7p|yoxz;Ol-R{_e^;h?aY5t=$-j>ou*V^-8+X(&Y#^IRAJtE`VH)ipX-L6@V^bNo
zXgA*;jZ@N0nb)?Hjj8g}+QTpe19ZeMm{<h@f6|9KQTs`mt_EnP(Ww;%>K!DB{G6X(
zc2%2oCF|xB-lJ6vrbI#$&Uh3Fwa$ckZvu<-CGuIHz^*DJQs^FWk<eJlYdK(66t?2*
zEeg8`UsiF8Cya-&T)Y<(jqn6s?cYJdfU1YZ*v`&;2WEJ8@i7vmNerKlS2n;Hqo&x1
zCSzGJ77(W17KmetE#fqAhx#$r{d0qB!W!y0NK~FI0xUs<`vQoEhp(n{F3mi;Rfy15
z63P*J(`e6Bnqr;Rbyd&xne7hLjRn*dTapIYG)w8acNx0y^)NOnHY9<uAMW1(OMgV?
z0Z~py+beIeb(yrF`K8HqxBh|u1aN3<nEcii2XO9Fa(LH*>2-Z8IA{hI$|^`2x`?e|
zY*NNq82hkjsH$61EMP~}mag}CjoCiOQnMk?@6Bccj_#bBM5O>h8mM)3q@fGv4P#Tu
zbe(A=)mj{P@F|P+6;eG&1c_qoqY^WD%gITsI%Tgx1fsI5T`M8lwYmr_){Vp1KK1~`
zRFRqeXuMLI@DN12vLTWLd|g%TV@;_b2$Z9Zw0S%`Pjh$NjWy2jhF_p?tu%C@$}lDe
z<cch<`yGjCVQ7D@w|QDryIC-{0&Hsk(Ky5+$1*sI`Cy59F&OAa82<urwmhDzV{6*9
z+@|%mtJpBpjm6x7b6U?w8oEqBjA<^|fIQh&bC)2(l_^>Wt^tcfqImzXa|mVQt27bt
z@~CEnsS4Ej!q{usnF`FMq)PVQWk^ERkBur>DAU`n6ui;w3#)Uy`kBt^vZ{)^w02bu
zLn#u1|IxQAzZH<Nvx=$rm;J3+XvEIoI>8J(4C@gy4cYrtviZtxm^B}Q{t|J>8K@{>
z%$lDTMd|v?GdjA_PUC<oN_Fs`7hM>SS24$|$Ot=Q^Egu6dHHU(Mx!E}ARaj%LCC<G
z6IM93t9=2mHIHJ(l7y)a>5P8Yq6zU+l2OlH?B-*)GB`F9NKUVY1;V=2FoD_??Ocpl
z(x$*hgs3-*+iKsPC~8FG<;~@thk{XOp2$>bM^i0Xhxs(7#e6Q|j~(0R$`D`wvhO7W
zs%vR<7CDY%4eByJ<y+Tu(k<Zf>;G4y*!0j)V6!N!&lX`k%v8WaLkJxwGZ1Nk;7lU{
zY_*=REC8Ce&NuD))s5M1u-}(Jw3cVMI>PhD*BO`>sc=db?aqUbGm`)M)uJ!JPMgnV
zY;^kkcqbE!HVXm*#N-cYrqMn=rICn~Bc~0PT`$tRB0Dt$aJ(L>+gNA&%HARO7Ea?}
zQ`()P#CVWBX_chf&pHrbiAJ1HTYF3h<J6f(mqxeQH30zsLK1FCCwqlAk3#gmQGVDA
zVVRlQ8CSQ2#&De4W#};HV71OIjVWTlz*r$PRLh*4hb}V@V`^-wJvQsR<K5kiT3md#
zoiLuTKu&FvhAv0T!<c-~euQmu4#~_{(Y!jK^Bt3Ho3~Xxf93S*$NyEa?VEV(MBo!x
zWNH8Qt1A0zlLF2|a#BDywmkRx&wVgiB_skf0vj}iH0XBI;&cP8q6=UH28urb!T{uR
zwq5s!5eo}Qn=285=p_N4D`JOZlu{cI=kqURq_>&=6iI6y07vy~KLF#QK@g*e4HBiH
zOoUl#@u<8p7}Nwrx_mNMbuo>iS?1v^?FXds5@ASC#ufPtW7v^$4$xb4QhGh2p|R;u
zihsUdiQ3#$E&QmM7MHSxXGEGxhNm$zqPcLV15BQwv8k}@gE{T-(}C}NPxVBYs!S>6
z`KDEcb+#!@Vget?&4}#%&lh3QNgy2-0bczA>bL~7&oBz4vp0r!&cTb<ob9j#qXSA)
zV`=E3vWKy$&GAN`dwJgPKK%OePbXclge8;*LYe+NBu(FsjY71W3Kl(UGsDTi>Fv%e
zU3SK2to<h_M_WjBSx!T8tf(6^;2Z&Y#X;)Z;P4}B8Lxvc3in?L(b#$(2NsrJchD^X
z<xwcWi&TobY|~<mUA<2!7mHe*T>tz9uc~&@>ZPegH^8LJc5-}5bvUg1C0r7jxjvph
znp0G~tCl^SraO(#oJw~uNeI1uS4SOJyJaDXp`Ww6$6S||j$QgtK;puFN$KjF9Xj4%
z@7MWLx_MdO73t=&$hFz~=l5pot{H=YoCm;wiY~njUGNQK3zL$*^i!qFn%UiPx65iB
zPh?LRly17C1+XLVxwCTJRGY_TR|>J18draeCdRa%r!*wrUhBq`2e6=Y18!<dF!krn
ziEu2t4t&Rac14WOh})rW3UZ$NG9*Rk`Z0@!dcC>(Y6wIB=p|Lku3ZyZg<^}(T^os3
zQ_mJ=1qn+ziwGNDO}#WV8d6)J8ONBACC<=ewa81%m!1pa@lhE)Q?iMsiXNu~yL~8d
zD360gsdT1+^Qu(W%WPHv!`N(oqP1f6wVSq`j<=hQlDjbm5+{s?A*Q+ZuM!TqB)i6U
z(H5jc!4_%*&Wn<xjS0J09ENfE_PjK7nSL14kl|?q_R}A>I}ex&b$K<F<HKI+A|^_a
z-b>Nd3lcDIqChNZ2V*~h1B1!HCJL$qWJjo2Oj6a=3n~)C@ViSI4cW3sNf0E!Z&a}E
zRo+g~Yd|G&l0-_^`Rch-hFT-He``ILT^3ODA-k?3tq$2RHZ=y`@U!Km__C_^*Q!n`
z=MllDoiD`9b~3p-p24+Wkjr%g+EjZW4A^T2JkDEGUBD>aLY5=}Q&{FQBn#JWY|1i|
zp24?n4r#=3+y0ENDl>co9Ilt+#*Yv7&ko#)5>q-fBD~8&8O(ug)@In^_BFePfYP9m
zVj5kBWcAXGExj7_g`awP>N0KfrwshJWo=@wo?C-Cur)SzKV25;6ZYLE{1`wvC6s32
z+!E;({eG{GDc@s$x;DmidTRz@EO*RIOtC+WeJu@L5DsJNo$u@(yyO#{h0(36<2sYa
z%H%hqPPq1Vwc5GFiJM_M-3TkNm%{wka{<dSq<vLmmx*-i4Ie4Q@sEq<dIa4>5M{n>
zem_L?cphbvP$^;kHjmwA`$K`nExH7Tt|*=3%4=Y0;H?RbQb!wPz5v=^A=i207A<f8
zVnQ%Y^^%4z2!^q-=RuQI(nS*@!FkA(9N*AB55-Q0z@h3z6hUa5XnLz^tu+uwX_0@<
zwtXQeYo&@rWj|BDPR;?Q(%+O47KHEz3jZZEW<&&P8U5k9<IoQCkj-of!;;AJSs<Lp
z^uDrnW)Vdp5m@yr?p`GzN_X|C*PL)7h+w13Ls3BD(BQOND-H@QbskW{8NP}?i32_j
zK5yD!QfjB(91q>y)VZ`@wn|iaWx7QGEF4F$7!tOab4nAn{6>UX0z}hT*@(?{24xnd
z(U(Ju32a2QKfxJVpP#WQa%?O#pL)x947>dNYB(Fy;fh6!d14C5u#Pi}rfo2_xU5O9
zH-R;O+#9ZdWli0>6|T}{C(|I}@#yp}Nw9Q=te5Qxsp06$cqJp~I$zC9k7E&GQ?=A}
zDaJG(un_L6dVh{x&R6GLg^5BT(^Y!L0!{@}uc-zs8d)xkgQ>t{F<q_xXu{6V5yihh
zeSJYE-iV+q5~Dl;tR_Z`o%d`k3|t5nfJj7)HBOX!8lwj0LPT^92~A)nwcQE30L}aw
z5%tT&Mp%wTP_ASFff~ksUkYJFLIT1xJL;5TZ>^jLe@XBZ4?E5=<y2AFNds5{!BxG^
zNDvFKXH2_$Sy}FYD`|Zu0Zkd@0{~lY7!^qXJf_xz+2++39ll;aU#;ubc&PKz11#sz
zY<F^UmzUeT+}R^CSI@+hyIC&C47xs`;RJH?kd|duc#-dHt#gDqp;Ap6j4Ibv;V9kr
z_R9q}&!rskrx&-(3}6QKIji;_m9<hp#3L><kTH2`V*TjlBAy|WWC<*5;TbcrUV|#Z
zmZd^T2?fSI=AMWlt?F=_5PnXX1w>%adx1$cWS7PEk|e}*MNsNt6e*Qv<5w&lr6IVv
z(+r6LlhptLi*HD1>Rydd!U*da#|o4XoFuhJ2X^cRi$-I)ZtApoIOlS9hU2<vk2C$z
zjo~mBCNWilFY?fZG{e{;JU&6OZv1N@!P%?b4y(#ICCGdVvH&+K*1Hwaf7?xY5=G#i
zj_#f%gcAkHS<npP&n}9upL*O~b~wx8C6||Ofk_s|j=^YbW>2Vd;-Gcs?|`e}7+9I<
z?gtH|+m_9IF1ay_sH<GBroLW=r0v#^O*g(YyDbxU*<ERh;haz@h%OCDnOyzY<bJDV
zns8<s-9twK<FKeYp}Q-NwhLJlt8d8RB~!M#Ci57PL~6ArO5-Gsx#l$BbVRf)a-qft
ziHST|N;eD?^1x8cBQYXR5+y>z6AOwbgqV^~cyN0Cf}0i>bP|2Qd<TS@m9k$eAS*Wd
zGN<2;)slfT2^VC1la7*A6a{#@gb*I8B}8Lk<p=En6*><jREq^14jK^wQa-D@B0i_|
z`DV4Nw`R752Z+0iE8VMdcTBb|r<LclI0XT|4Ru$RW{lj$5+h*=-d>Q`MH;%C=nZ32
zAlsst0~4)6@Uvi3l30j<Q6p8r7sC^UxsE(o5j#@v&EJ9cdpxAuStBl7Vao^trawyr
zma|nXx*3y>W5Wv?j=*5IA!Y$%IpR~xsT(^LX`sOK$CM;$InE#mI37b!FMa50j&$e4
zSTD70JIC9?*Viklc&mA|8)(TDOai-@2O{AD7M^gW`Kx;5GAW_Xu)h7cObNpe5wVe7
z+<1rsQ7%Gm<}%sRLb5dCz?4dnOKC__h5gthfno(N4+X`+NFcD(tW5mCDmk?BG^TNk
zrIbgvJG22+Ox-~uwCQY~aH4)2Y(*OI2-|!}`9$*2Id$PQCf^uVuvmKpUmME6Da~_^
zMF;GsPq3^J!$>4Z{vcLrkE?Q@g&}r7QP2c&z|<55U<ItC%q?havi9m=PJx7>-M01c
zRE=aBFUn3l9tw6^lq7+gKLHX71dGPJ{US#Uc1OShu%FRVBShKLN^Qug(Vbv1aXP9M
z9|km{LRb7_pS2IwwwYIuftsD5*nP6#TbO4efO1KwvU6T+mnMpJIXN+2=;m>fV1}0I
zsCnwCMuGzas{OJU6+og$UbjP?-LLV#?IMRJ#zI7DN&RJ7lH#f>=eiOOn_GHq7??=8
zZZ_%teO2J`K&KsNND~qg6Os^)$LTyUouj}+BuJ9Es(TDz3aVVVR(WQ=+2i%=0BR7q
zElk+_yT~#9wVkWjXs(VO<EB?~d@e(h$=i>arnX5tbIsL&2w=@%c5VjFs1j5d=Efpw
zc>zu%mW0ms7%6;hjc^T;^N@t3ACryB&-o$zbB(ZHU-u7dfuG{G3j-_0l#rPwCHiwc
zkhD>(InDpFxa8GO8($eOy;)_oMF#;_r;@@=_FYX@0$_lejbe1x6E(G8iP6y{<|K}1
z;D9~?B`wrjAK)}^vu0E02drcc{_}!MA2FyK?1LR)Nf92J3>nI>Z(20BWMJ5k7`z!h
zm8@GWPCB<#U}kX=8WX~nlBcU}G~WBCq?y?pRX5?Ca|%y)g5-E-_3kF#2}$?Z4JdCH
z7D&I@ss5r}4=zW*LlOqq)UQ8V)EmMyAh05Ao}U8_rr&7g28YUCUMEsm$W)?adDaYz
z)C|Xy=&7sYT;j#`(^C$IbyuoG6R$YG*WW1qG@tr?qk@<{C?Dz++Hv_&IuZCna0-?s
zM?GM=n)WB^OHQ<@TM4ZZh^{Me0)?8F@~k-ArpGO8%XTaeee*~sI>gZ`Em@#zr=1~=
z`{U=&7@R;Q?s`9+xp(4#In`W!gknLK%1zygeY&YDi@XWPcudv>fB`0-MHA2{AxcAU
zo%nNX29D+5GW!&dBSS2}A7UN|Q%)XKNr)YU)pIhfB*e=~p(fUUalNdHf-vk&7!dRZ
zMa+{gXnm}uQxuVi5)GbBbwsD#v6DO`zx(5{pO|Mp@jc<pB%;-8f3TvMv@wgPyS1Av
za@lS1LENmDTV>3&^%r{VBB3#7vCYn~ZZDy3uRrVN1ToN(S=Y>#i^_~zHF*UGg)zvB
z#HPjE(nfPg<aB@O_<4bl4p%f$qEM!5{=m}-CXUTgDyG=x)FKnz+Ct}&rwg6Dn+V2J
zP{VqKltoLd4(z`aky%wLL>Q|#NXJ1s=R`S6o|!;u1b8@!!3rWg6tPgOANBGE6GA<@
z($j`;AYo{QV-tk1SHSX%L=dusCq~t^Fr13N1uH+cR@0X|d)$)Y({jN<zHv<NG1*?z
z#8kbR3c_8zQrnjlSnj3Y+TQWxKxd-1oQ4iMG+DV_-*21s>=_&hI1OkVz$Xc?pF)$T
zyzp8!*!TgMPKFZ-TS1CQKEa_T(_$f2;y8eZky-i6uDRUC-I@y=faX>NjZlna@)}8l
z-b^s&-5!U{t0F`>UNdEUEQXO#Odis}ST}iTukYqCl;SvKD#ub>TUf(=4$K#V|0p*z
z`$;TIOJ{;$B^i}}&O_36>c^DCrJ;G!aM&<sQIHkI)ZQ?NIZq-U$#PFV5!Iv%F(yLr
zIYzm);LJoyiW#WOvgv9UZSy+}IoVSoU|UH)#I$4@Rj%niLpi!cN^P`0;xyAHfvnJ3
z1(O0kvwJm>1@FW1ge&SGK!a1wmP9#BxKg=nyijw8#i4Ys0$&Y;(XEpP5cZ{^K@yk&
zxdroyknVWKew6{FY)F_GUX5<}rGLi-MMTk7RC$GiC!T~l6xN<E3J7CL<U$Yv^jx4g
zE4%wonxl`w)4Z=rP!*4PYQ0P*Vx=UH`7#*;wpT7oB?3KVHCY{$ANm&>w>K@HQhUNA
z?pi9&ucjMzJ(N%_-;6o%Dz)I(V9}T^D%nAqqs;O|era|)pnl8<$iB;$ci05_h&YHB
z&__^3>_~iLZAY$FMI*6chc90!_$^}Q886nT+e~wEc;Uq|jbf07WWsb~h841=RGAwq
z&90CE2+?h&jw*km>Bk^eq7i^$NCALjqr+6O3i!DcCA=#Aqh>^gR(j#J%V3gfb1}KC
z2IcjyYVYu_OOw@kTI5Y%%V?R|eSK)dS=|?8PdLKl_OkuOk(_JAbyF}i_n3(>9b9wn
z1ZFl~Fd3NzU@)r%Rt>ioY<YFYdvqA-Ra%BhL()CEer#&)&pbVd4scwehzzf$@Pbar
zXuHGVy=BFqRlT4EwN@gY&^QWCuckI_+ROGDL{WE8$27+6ve+Sw)WWjHg_@YTdN}=<
zi9q)28`q|cx>oa9yrVB;bqal5gh?@iVNAZwkhlBv07&Yrt5t4~3tb(~mmVb>YoktM
zskj!fi&e1(0*EK0KDu9+fByCmbcbv9TP|vGe^Xu5?%*a7Dxxz;$y|zYSQatkW6^o4
zFz|SlZxfZK;Y=MS$_OCmY!;K%@whgm^TOR7yM%aaoWtDwa8jy48j`Hder$ZR@YLAv
z#&av3kF%$_5>8iX{-`7q%%oJQexFg$>-x8yv#cbg9CEyHYQ%Ee-f;y9%Gu!3wHjlL
zPL-n-?E=7foiC(3Rtwt4R_Ua>I3F^QmtYUZQ*ZLrrgryo$SpxN5`&>d`0#27Sj7Q|
zX(l(w(1H=*K$0YonQ+*Dnz)+2RMznOT|bjL`}YyO#o?O4%pPWuK%X<AbW}V;u`2}-
zivf2^>xT_68BNqD5n$Z|{WU#A{@U}%K0~8hfc{3F@r~hlSFU07pGzV`Bb%qR*wuNd
z>m_{52PbgX#W{NKqy5yHsAaNEVyvM~m@H;sh!djvq4;Yej>r9A-s)2&U3#qZ`xngv
zU)<j8Q?~xc&%fE8_KJ?Uqlv=tM8@Qb=`=dhM=VHqpjc4@OU*}IOcn$luq8}sBOwi4
zR(%*7i3p4)41LG!NhXo{ZE8P1RVDJ!1<f#~L33*VK5I>cVB?YmEHfZAzMAe1YML)a
zfgsrHL1h7uGm&!n-C8Ie-^2_0Mb>8PY>Qb<?kk2%mD~MD;no21B*#iZHlJG_h$!TE
z08T*&1T-|sfyK7~;*fB~rI^6+pxi#Vg_MO@dNaY}&PYB*dz)KNgE4!qo@qa+Mmt`B
zSfyZnhXlLl7!S-f>!8cBU>pdkq-`E^v)+G`-h0x)z5Oh|ADgO**%0*7>Z`!hA`*)0
zi3OV|i&eQ8VgIo4c@kN%QBfr$6HcblW_DnKJzzxndCOd9!k&(Cyf_y?Fw0g2RH%Gn
zZ`excS%RsmbQ9MFTk$tBYNbj0Av}t}5bR$~={A~abPr5PKnPPB@U>~(9(6TNhj-qb
zM-xKnJdaXLIDK^?;xC*=vYhd>Z1b`yw5=1Rci(>N(ugnFx*{6itG(JZ5?QkPUPliY
zUO<QI9g{dXjzQzTi{8#EH)A9_W>|4jUWRT+j3U`M787coeBpuNpP75aX&{h5;m2{p
zLu^wPDK`p~z}wVF*Lm>~<sioyotO|92Qxh#c25nkZXN?0AD%`Dg)7x+;!q@^5`+|S
z0xPPX&@#@!QHV6TCg)<;_Nd&bvzv+OfLvh15Sb>@&?T}lj7{MTu?i~|V`N%Hpw?N)
zmD$fj((L`1%ypO+Z%nm&HyC^G@@-bO`F)PH!T)^8da1zk8Lp=0^J#28Qg%*6Uf&(_
zLKh7hsN6+?v>#xunVgr+A=|W-PHFtOM=we9#x`#@Mb#YZ?DslP%UzLu+^0qH8&Ya@
zD0jB&2VlK(;N$a;iHuPQ8#d%hiN(v%WgiY>s$tL`o4d6BwratZ`8M4=?&|7TZask3
zotia2g3fUd20p7Ru;Cm?*B51%)gRmJ@XOHy4%$`U)OGdj9!Q(-GuYMHuX$1YUse=8
zU^+>YUyC#^{ov#ir0=TD5sOnIs!k%ghjv=QA1YiuT*qH(keHc!WHurGUG?n2vL2hP
z{;@n9+h6PKDX)&6$j!5U`7LYm&sqJ?tZws7>H)JgSz2!%x@G(p+tD}&q)7HBA9PJw
zZL^OZnZ7-Obx=0$AxW$DuZO(#VA&37nf1og_g<;NixB-S^TC?ScBpMWW(8Q#J^;dV
z<h!)VeoyZT57=m+&kq&s{0}~u-}hi2G(PV8Z)=>`FPZ&o3i{VQoax^8gG_CmWu2{b
zvYvdA-TfK5Z?@9US$XVto<HJp%38koSeFonN5P9WKYR<as;bJ~Ht+yZRTV&_AKPs2
z4_DRMrmDBzXc<^FKSY7-3;bBNm3u^4U01aq#Myx--n{&frCU(Eb=EXKaPnM)z%z~a
zF)tpfW7hhBNe<k3Vy{Suz6aaI1E!ytP~R4y?%d-V2Y7y{>ilz6wtj?oI-kl5cj|y1
z!Y}2APn+z3`C{JaJg^0jNS@fhvTS#cMi(o0kLnb;@MOt`UFIGLM&d9A_e0m}<tLEe
z9$?CVeahCG-F`ma{vA}@_jP)B@Pmow%qLH@odKpt2A++Oo<KxX1}WxQFsL~cdHa-S
z&);F|93KFk0~@|bk4=%K^?QI)f&J+VsOPjU^K$odw#|=wKcv}N%K8CkaQZqy;0L1Y
z)229X{ox^L??2^WdioSf+@Y5KDZR^z_ZU$;ww|Pp4g0S7fRP~&*6<WF1NqeEr4M0*
zvl#dYp0P*9);U+i4>%_>z5n>p4?q?x&u=^QxBg_*3y5gt{o~-7jkm2fkKQPqK`r~i
z^U?u3NU9h2faFNf>A=dHX#brTTWn$({FL2$U>J=3J5K}>3QT`2&SCR^4@RaZXO5cm
z1NWeY6IpLIew`In>d%4o$#nW3Pb{ZtmWUt9Wbjq|AX0af?o+tpbfDlKiJS%L9?izH
zNSAJRd2u+Mm6$~99i5OuzaDEZg1M?Y<cUe7v$5Tyy5!Ee$1+?(^fg_^m-|tp?0!!&
zF64_D-)!3a$pcEMsYO26Mw2^=p4|rY<_e1?Ea)Cwk=DBmld$@Tvv<1qVzc<7k?*S-
z+yZBOH7PF<3dS#W%h@#!Nc!G~tA}=9xTXEaPObhk&z@I**b2(r0LphK=f^dW-?LBc
zuXVLQw9cVynx{irW1(W#NKOLH3syNd55*?nT{{owkUsiD9WOxS<sV>yI)~wfK>3(&
zv%9qZ73^T=SU|8H@ajLFh5Li*T+qiklD}1@AL{Td<2GR0cE?<<5e*FUd!1z;`doGQ
zkUFXRw;KNC91Gen-`DxpIgsH*>s$lcgI)D&56P2_)u$(|)1412{M{v63S->P@nEby
ztuY|t8cA~~(iaTZI!AJHP5$?o)h~W9akck_f93KWUeM;3J2X8dLkIqqSEX}Yr=9-s
zAu9^!Xuhqp^zl&TW$TqCh#=e(#}{GTQR72*s8@Tjw+2Pt__0iV^vV-318GiX;O{;t
zu2a<JecEQbs&=o_PsZ13(>O-b)rs|DPo16Lu9sI`6==KT)hFl3e$LuD-*}}TPUeOu
zn;r{;=V)X&M{=?*e*E>lb1WyZ;~dBkr)W?Z|8i{c{L48e-F9~lYKR%EpS%)?9vqOB
zS?h_Tbv{z|L-L)rmLF(NP1s!HINLYwIrrlR9N_m4X<quIzwv^^$2Q$O`UL8a#)I&{
zMd~@XjX$<8g<l6m{zY>x@e}7zdN<fPj9-g%gLyozarE&&=P=G$KCXd$cdm`=gQnh8
z+iag6oa4ZQh03W*FrFz4gxsko`D;xhQT72WLv071>^?mf?dp&|`atiSaC_I}$Z<w$
zwMh%@f@I~pe|&Vc9P+g%_ZS{B_ZU7uy!-uM{_GAGhl%`irOn~X1BWDLG$La7;n#ZJ
z^*-Hb_TqbdGe7QE=|R^X6pN{#yRCWaH%q6qGJ9^*yVYTP?}>Ax!RXx~*Q;8{`CpXe
zYjM0UwGY1*$6EmCYjM0KpuQHzTNuLqS{!f5-v3%0@5}bx*W!5dV&H3Wyd`A%S{(09
ztUOO3el3o-P%Znx^IwbO{VAR7M_D>QYW96Cj<<aCe=UwTTPWvialCoc>1%Pk89Jrg
zy!x*4Ktz8n(`P@g`dX$>tGhglxqU6u_hoeQsVLCbGJRiSeS9s`w~V{Lmg%$D`d`cR
zeUUZ$wM^gZ1C;K;`C6vWaWOob@#KqXU<)g|M|U|7?_{Y@XLN&d_QQ#S&)Pit;I+st
z-hVlIz(Kp}8}N9a-2;&|%Kv332HazsXkULI$<2v9vk5Lj+!qUYE|tzb!t?p_uXXm6
zS4U6e=D5%MKk-`B#*Z%V=fk;g3m-BY6v^&IgsiN#*~gAd-WZ(Hs(Et!Jr!DBxHGDM
z>>kf3hTtC1R;~o*9*!Iv_aeY@5B7mSj;1WF>pmmLCz<_gdi3Fd1;fytP2yRK&{RhH
zv3x_qfN!?aC0W29aXDQ=Uwo`f2*ab`#pRTvSHd13s;UBr^kbXt{o$%Q+f=nbsUJgT
zjC&xmFYsg8R_+mXX$^i5M?Tl|CW&b-Lg0xeK50B(k39Xb3)EvgFOo1Orky8A2IBzF
z4^^FiuFBSr5Kre*dErhS&_np8{P1a$9k3#hH##pHDx>))+uftl#me2IIz=u#S+Zf5
zxd(zFFAR45ke1sb`w2_sxW|+M`;@IWyZwB9?srge&acmnXCi6|55eC2`M*{KpCirJ
zir`BeGxt>wzg7gFNA|TM`0TOq*NWg4vEv-b*NWg@7T5S%5!}Sep2(Z8b-1log?oPa
zT8H};+uXS^__YM~Jfg29uqSKuwFI^*g};`-)}Z-X0^7nWJ}7LIC0+yqPQI;kAirmy
zu%qVQ0~xz%o(^f<c;F(PJOM9Q<=ij)p=#Q7(;n}fL;C0sb-VzPmtJUPF9eFGmbFKy
zF3yl^B!8<)Kh)t_#%;iR?aGL`Ml>)CMiYlXjC)9()csox|8kDyboAvM$PkyR*YF>k
ztZ6*hRm16^CmXBxk34C0_}!&Qt`}{%v9M8EWAzEwNSZ^DzO+6ZB%fT9|2<~)iyur}
z?S0{2`6iSXwCMvv9)=LRT>gI?d`y)%NuiGqS>ZltbP2Y4Wu^XJ9WWW&$My3g*yoE5
zYqO?x6^I?r6p|ojf}DPM`1VhWJ?Pwb^lBgK>h2Egs^>Is^K$1yx+0c_b>9%G$jis~
z#~KZB=QJs+_8Yu;mu-DP^tr0`zZ_d%;ACmj{tM(se<Q&cRGYeLnjg}<_61N`)$PLv
zpcS~_?Sp>=>+tynX;)Xz>$~cc2S_USLa}M9gL@QJxZV}jod>!8S-C0>b@j&u#U&=0
zm)mdCdR69kt_|Ss7O;CDeVbSJHqU!(zxFNc>jn%SbO_v&=5KioviMkjm#0OwbC2ie
zG%v9vfqNv~I%W00U^i9I?&18N-klnqx(D;k9jI~lFn}gq2+28+U+e5XtFv;Gd9XMi
z)2Hm4O&`jCaY>)aOoR&c>k4*U>5T!`w4nQ(n=D`??67WuFI4He_^j`IAWdiVqc74q
zCFq^_<pDH)`buB~@2lDa8+e~LXh?OJ)7+!!dw03!>9ojGZ}xh(!Me@m7Y8?f?)Rsm
zUMXf2`hw{!uGbG9F!$lG$~UF!BkwawJcvkOIP}NT7jAj>PFZE%?eeqL;TNn;RusNq
zIY*2AB2klW+w{&o4luxa-@-MJef8wc;viAFx~=Y^l<AXu#c=MH;u;8^@A|?dr$cA=
zNH*2s#TTl;)_KUA7E7Ku$FhMH@*zFpAuA5PtPhqx0G9y6;=Vva{ZnTiNSCtuuCBaU
zsm4EFx6aCKR)ffEyodpZf(KOodGiPUvAnNVhXMqe>yxa_FCR6>v+q&D<;T4bt8tUF
zk;fe_i4Tt(CP5S=VRZWWYfW<@>GxH&E3*H3-|NcsaL}>Ya9F5$>s+Qq^WOPtmF4f8
zCv0{RUmbc(|HqtL&sq{>pEkvD>rYo>OZ!PrD*bxZWqknCe895g9xR`S_5OWpu<B6-
zdH>4m``V`0-^Q~(btm$yBD1{peQAR`2<)G;E!f$<kg4nT;Y|w(zq%3mS^Ip4C98i*
z@3I0*!hvi5Q+Dq`>2dG6@{X-;Pi)8&Q~l3JKiJ8?)+3&Fv$~MUmzKO<_Olvwx%8s*
zh<A-{H~k$`f2_B^M(ZZ;I;fs|N%$elz3ZUb^xYl&ppLiwhrI0OCM!H&`dof(?)q9w
zs*A|^WKY3XtbZ&IM^Bt8ovY_b{OO!B;~I!xZPL8%x_91pKB^e^Xf8(u?y<mUZ619f
z%A5`EN&I40eN)#y7z1<ka*uF`W_Gar5So24884;M$*J?k03Li7pV|c5Sl$D4mm-jD
zUix7F`r0x0Z2SVVKjqcY6O$?{vHYPo(gB;9_KwT<UMQRm*2#GP7mD0@>m7TMj4^0u
z;H~4qkNxLkXL_BAc8_YxQobDW%SR10PV7e{Xp&sx4<tYOFi&zK+yiM2Mc!gJ$M5o|
z9JZfN;X73~f3s=xCl9!MDi(Y>s+HDq?}eNyt8MnNlU3fBGH9*;<KS6ne;j7~=THs7
zJu*wWw0m$}H3EM)Ya$oE2VV1lOejWCfc}t{+ami3`?@*DWb-II@t@C|5-%V2T;>5N
z>G0h>nkmcsa)^7f``&-_Faz#;>>1)5(ImywlL+70Wd8`N&?A$5*m~}PY~?;8?%_zz
zs2_}Nu~|H^_YN8GciDPlx@^ylaF2}#<WX&OPt1Wj-R9MIl?VI3&Nfx;&-vO(9JxoL
z>R2yq??GvJkteyWHjmzLjm}&0L3!MHA#60hhd*)g?t-aL7tDqu4L`srSCqW)(j)`T
zsr@saiG)ck{RsBvPwq);W&aw~`qF;v)J*TkU*9{&@^jYK`Npd@dgqEHYpjD+gR0Ex
zHOBUxBil4jhqP`o_YHF|4Y42Eec_m$z3YDJU(eAKqQ;L#jQ;dfKNWxQVwFxR%Q=w2
zwsVfduePt}LLq)^B7ZtzpQMX(ApW%E9-8oa!YV$ucJ`-LI5JLkY%xIM9LvW|b;#a7
zq<QI+Y3yt3@@|)X=yIHEFEshzz;o~d$gf4Z!7GNYad<(DQ<TU9r{!czyieO~hlQ}c
zq0OdoZr5zHeR^<Ck*?^c7kqot*Uo{QV`>jo)2^HLc;_6F9|l&NHLZKMO&7Ux4$2G1
z;MnFxjuwk^B$v>Kb3yxIxb^SH7W(dT$Iy!?xleZYw{@029;(~}C+TB<ch(P{@y`?a
z*uHevy!_#v->U;AVfpC#`-tgdXO{o1hJQK7GSJ5h8+2f4T%$p6IEOSusp~cTN8f$g
zIizz0-@S*4`NbdGbo1zwFzU637Yu#TseXy;>=Opq_6PU-t6wbVF#4dQa~P7X;Ssxh
z^yl<)5Xb8$AHbY^8`M|7coNh9?ws)LgYA3@_&Gg%8P61wAZCJ`e)!wBGTPK>^RTY7
zLshryrt4MqwhfJR6S(go-D|sayDIZL9q1x$nygXZbrT-BuiT?}%wDo>)#)8)G?~ss
z84u;Jw-=h_uE?8*RRN;>4-J?6RBh5C|J>bxYT6oG6!}4!+szblwV&YIn;Gu9*GXBK
zhE{?a+4i5!0McoY(=LzGnWT1q-OpcbA}MJHdzkvypT4Y0Z?O2&M*4GA?ZKY*g)klO
zd`NxcoeU89$I&M)T4RTFP~Pql`PEE0D~*=Vw{`X0Wc9!Da$7ySw@*K&PuVw{KIYk{
zygP^VHz3WoY3&}!?|thW_dtG5^Ac|ox<~TO9f(QyFn&+(PCm7JFn`Nykk7~RyF4wb
zoqIg*u>@%+W<WCIiI{sxzt-7(R%hkLhrmFAzGt>Nq>s*-*rmXo%tWYAzpkL9+i&o?
zc((OLQCH!*X;Tk?l;8(@=(@BI+1`V#vIB>Cd+)&t`R5><JHNQ5&n7DhUx;#EtB-z0
z1iH$HYqTw$FI$;Dxd*YYp1fHbbZLFT(xlrqy>pM_termk870}&Rnz>C=CwC~s>6#f
zSa#qFtnaE%?vbFWRc9XPDlq#V@}|YxGR}ztSawBq=Ry6gXYcgnK5x*8?e5RGNAr*s
z{zMqPlfiX&h?mu?#<72oK3!Kb$vsW*@=W%r#n_!M%Y?@+KbF3r0U3O7uMRd3b>)Mb
z+lL}tQ=>EXIz!Jd0n?`poNqmOa9rpYefrXeuDPek%ST@*k`{T|cmw8e@F08dP**!_
zp6Clz%IvxGa9y+Q)6lX5ljeP)%{fZ6esE8qzALDE92cT^U^sxOxvy#uT$4^``=E{{
zY1j#8(Iv|<`VY&d`-@~-eqU9)BKxoRot^6gTik9Ys^%TWZ^ePPnnyW3&6-vF$&0j6
zHItKE$tBaUa&5UV@#EAtP;0R0{z$Gm?@fb9kGuN$*9k{P<V!EVGn;x+)!h4@DnqA*
zQ<;1(IxcwEkkP9a5MDPq@U!>mxu?4yQo*<8>HhUzcuwmwFLyq5%aFC**LHm~fX=O~
zJ9XzC*T7GH5UEIO*lgz;$lfTH4JI%T#k;%#WwD?<>2QWchY^lv&5_&u@GUl|tjb>1
zxJTquQ?GOSrfVSZS(`^6RIY3U{8+Y?dqlhHo7xNe$h*#6*-#tB4>UWF&&|sZS-SOy
zk3rdcqr$xGh%KA5-xfy?6qaW#1p8B+`k%uArF&#(XLP-$Ju@_#zMiNbvS@6Kd150P
ztXNN4hs(0yHy@%%Hgb6sI|UQl53a|65{8m~NXu=J{e-2`oMTdgN=Fa4+{RR%FqCI4
z>L(h<6KQ(Z(cYMNr?}U5)#iwnxgTPo^IQCY;!n5pIo;v`!gH0$qYng|#B|+58p65F
z2V`&$w*Tl5)f+%RR8Lv$MZ9fp*Lk8@&glccgGu~-ogN<iVEFB&wMLtlK6vW`hj{>G
z<goux)%j;2lNT;~?;!k&ncqH$h0B?Mdn~eua*xI)pFERI|KrJ7?>VUg*!wB3j-Et-
zHl7_|UYr$=k_j!Rs_wzHef_r|+idTVMRi`r?lje>#nd^Up5$Ge?WvETntigT26xmG
znWg6TW|;?&<U>8j_RC}@wV-hvzxl&^*ec1d*47?%kUQm3IS2CZV_rWt@6evDfqxqJ
z?IFK5*PBOl>E`JgiFXa9zdI>OKQ_8gT;m5tutgp7N#J<ek?rTKt@Djnkj~k^esGd6
zEqguct?Wfdwvz~U4y3!r=><vr?BeH7dvc%JPx{l^@U)Ts_m~a+7JNa}<$8F5=%kap
z0OMuz+rL$%AFXdMdeVKH;!~qemzK<UCK4vG^ds0`Y#u4qp?Y3p0nDskWuKhX5RtfU
zbKJI6thR+?mg`$dXnS`y?$Kq<J4O-@aFp-9|JFT>hs*;ENB0==tp^xd_ZSX^dkpuv
zdkpP^dkmQe;_}eG`}Q~YFz$BlG2GYgF@V<i$4B=t8V^XZ^+0oF9!Sf~1Fg|Ky2tR~
zfz~KISc}$!y_tG|p}cdCq4vPCZ9I@s4<7Kt=ZAN{|I0m$ClAEbCUuYDv2u?AjN4y-
zcMqd@a*yFY_drY>JuoBw@L+G09;^k3%lChG52N-#Ol&=1iN=|Xn9RgPOfFx++b4MT
zWscWd%#q$Y?wd4p!EqklA7}zN+|#7%?fqZB9ZT1t%Hu9Cb>|GbEUk^>-t43QfSDxz
z?D`NjS^bo6JlHN>i)I}QY_t3H=*~@dD8f8>Vj>bj*y$&_)-*{X1Uub92*S5lQaR>a
zt+)C8y@ty^V#;2Zhi@i19eo)PhLK<i!)p|0gwoI%;b}~ZaJAXo9LIQ?c=UCZX$VXc
zMdvFhaU#tU+Go)%I~571lm~LO^;27?n|7UcDf`W;d9Z9M7OCGxE`+IQ5_1{OW$40%
z!<c+7a?FdZh5?`RQZu?wAG7u6{NNgOhocuucU9{HB2-*iy{eB&;=%+-9GW_qP)-Bj
zJb7wq=)zIMm^}3c-t6Z`lebwNUT%V5{Lvwal0f=4Y#q%sIvO(uyN^@(L5sXRe$sFy
zUS4yu{LUr{V?tx;J9=|kAF^7fm+p%rSZSLSrh28;3QZC<1`t#sNjD_oK#|)x22U?X
zo-UZIdg`ra9)B+TOMPy*;z1P00q2a7fG0BRaJz;Rj0J=-p|B1x6N#co$!V(}GhMTw
z=j^V3Z&T!1*{%<D_36dBWI+g)R~*F=jY$Om;1XCW^SR)_*dmd@GC>0#Frt7Z2}vjw
zGFUApn=rW&q^T?kB1#GTMMwkqBlhNx-n+k=b?V;${hF4T^J!h6Af{nL2u(u33;!@#
ze-b7u%wbGjp#jh~E3#eMX6vRs-nm#K9jJMRVP-H)1``I6pk$6hGy%mD2r^m7(|WDD
z8zoMuQy!|jKQb_K-7l1mHf|-(fM}oQr5%ZgLLM^_QWlYbh9<sYEau>`L~}@@I3%1T
zx@Gc!hfTZOMj>L7H6S?!<)Mt?GIXKHFs7pjUig{e6O$D^C4n?_A;B<aoZPx=t~d7*
zo&4srkEQ8Nrk|Kw6y9PO^`U~qaVRTX@#Q?u2v}M0LGqoT55ImiJy^I3K#5Wgd!2Q!
z#x151JX~-h(65uG57BT4=`@Vj6t=LtfGr*eVJL=IgZM+sGU}pY7h)qYE)*1$#R5J_
zCIU8o)28-UWm{K;?ybA7*pudsHv81B`*+Rz#Uv#t2U5q0EG48N$=&V8#(^TQKUF2S
zeLr!+LJ?hFO>wn^@q`6b_Bt*@7q4R&lS52-yH5{ma15&gHE``69-FMaI-KWxyUW`3
z^PD+wOCU}Of(63b`~VhGneH;z+|pCUF-7VuTX#G8Ent9JVo4Y%;e+##6h7$3#-e-m
zv;igkhf5qCIrbG8if-xA;V1!zJ22zZ3og$gB2&;nGmTcC;BTtlOI|i@S`^y&4%)4T
z;d!pPMr0f#JL|m7_G|29Zx<vtnBT@9SDoJBli&QI2L@f>!Cig!TR(b}75D2p+pQfg
zyavOq$<Wb$_i}J@2zDKsw#S1`u$BY6xmad^<VL99_?f5aC;aW72|glU+f?h|yVqHf
zrHw5$>Us};#gD!QNtc{OMsX4_9+TnK5OL9*gwZGh6P+o!9%ytiA~cCppEh6~sypQp
z4Tj-t)2<G8pX_@{0LJ9<EeywYlm-MWHl~0Lk|+$+#1z&gHAT~<xXv__Jk-ZOnwdz{
za*KH!iIRq7i@6&cpN4X>N|KN<coDF8G9OZ^oQE=kSq)MMhLV^?Nk|p%Eux{IGz=Gp
z{bD@JkCP~g1rH(?D?!IdC3u2tCr=+nz;R3oxW({maUf)iy?w~*?fQ_`?Td#0iu_Kg
z`+I)lryt*c`1{8XmgqYb5zy@XDxdtx$JMb&XdH!1MotnSIA(}kki#BiG*sfH0Bnyo
zjAINo0PzTbG=KEv^NS?lxB=Dq>)w=g3&Li_-Gm5jotAD{;kOUpeD|}{4bdZ5bs{uB
z?j7%ouK$?x-MOjCd)LhQTw{Mh*OYk9D;tJLvUK3pbiOo&5DF1;5eY?~f|84aK!hrU
zL!G5t*B~%lYx50M2r)4w>1jYnLl>1hjEz8SHno)!w}F9DvvCijwzKAKKs?W>klVm$
zd|=P#Ih*1}d@&;~Zh)dUfNk-jaD2l-aS|jDtUHG1a%MmjL^J}oNCv@@m@x2`My?1~
zrwL_uR9I)x>Ilw4o{*TRkD5JYWvj9F7g`o%Wz2`-VZ?;u9tE)g&qiGULE{)x9OMfT
z2+685^lRRKen|Lu%6{lH<#|k=@=z5P?x&{pr3nucs-#}fL`2{mD(efsmc$`Zp0Pe`
zY|m&+YMGE#9+Ki8{g_-aqiqkjow0do-u?TS9kX})bW>N&>X5b@i)Hrq2s&1JmzQl;
zm#H=W{#J93y!ln2e97q?@t1EFFkQniP_CIA>Z+~oj=I$Rrru~qcU843bh-MLPdb))
z0DC}$zuRU_yDqEsE-SM--<&RH!lL5e+0wH_%y@_?;R56}37EmeLtBo5ER<<LI1^OO
zAWArA82XR{z?BB`=d7;Qo9ghgZd%YP`}OG|W|GOSjuvBo+X0k4sqgAg+UhYYv5BT*
z9EZBwqOMow1j8*cWd87mX?LIV!-;2o+CPr5oHvj+3w7Djj)6?%Z@xbi>jL8<w*3`Q
zFwG*+ePFLffpXkHthnT%i*-4SS#ZtVX1O*TWw+<0JxAc?#E}-wEt#~y9AlDX;${0=
zubo~U(jnbE;uZb8yszAHlB_ViVrjq7^nC1=XL_q=p$5AW98C#{2owrW2;o5(D)*+}
zMnBcrAxm43z4v)mY`xLnn`(c^4JjW7UCs}Tu7|ra-aG?9>U&r;R@N3I<bo%_M=^Yk
zat0E;0!S2b&ciW~tUT`fHTHolu<P@3=MNsASmqx1e&zz?Ef@ym;XZHkr_7&Kx~r-d
zI4AXMy}C$H+BGF|j^!k7JRnOKD7#Cy>wKG)Z4OLS`w%2UX#1>bz&!L|lU;bngB2Ud
z;?I6Zo#oaj)Cof8fU-|*RyMiqZs*OQ;0ig89CRwvi-l1)kaIYvnvw3;=Y+&LNhB-S
zIhM}ObB;o>#GRwLh&K03yFd-zQmVLEoJr0g0V5^}1q*l_DYqWp#w7Y9eM&XHJq|CE
zX4kh%IxGvt$c@l==Bf1*T4bZ#2+XXcy%CNjJNZUXJaH7yyU7b6UIgpL0>%fzd_lMl
z;6yQt6G|uvNN7kIgV|%A2>EuB4iJt7G+=>tNBck-Z<N4t-@^sZSn=G3Wfq#2H{}~2
zkSq#@-3W^};V{jX@&S=Aq2}J~^y{=uYYKZnCNE+i7dy)XFOrjp(S!sMmTL~#+nZ4P
zYV)|pj3R#o$|0>AkJ97%y}LTt>xf?8*d1`V&NSWc({j5m@)A>q+N{1$-3J<)<K3aI
zHlTw%LgIFzFqf*kQtEs=`z2gPXdEZ8_gmT<0q2$)`TkJVUNEdq#(ATUaA#M?_Hb+$
zrjXu%gI?MPZE@ZH4S#n31dk7N^TRus8Z-%h0EuWoIc1@^n%r@o=c2QL9WzE}0z2O=
zJqm9O881y=$Jg;Nb8Lwj@&C|0f|DKLHa%Tq*Eprhe6Nt3gfzkx2?9YG3BxeLn8us?
z$z4JJ`>Nij&P}!RCFsquX{-IZI`sV--K)Go(Pi6n<hIW4i>&J>={U}@&H9pyl|LaM
z>>{J@H?iNlKO}ibn+Mkz21>Zs(A82q`UV2`@NTw*^VLx_z`1SS9$nv|ZQA;{X^(YU
z6ff(iw8&kjiy<Ib9bdSmDxGJaPM63R;&c+umu=*Fk@~{$@0?%!?l{)DOqs3Fe=`)$
z7sIdXxP&ntM}%V~VXOxoy}7zquj9J5fX>8sZ`?oUbvAfFT_J|qA`ve9jrj(JR|h3|
z8r!r@7xeYKI;3;v)w-E!7<EHGY?h_3jz#wAy<}v^Y~x3^w9340qX-hmcoRk#DJ)-v
zpEvOy_c=By7N_EOti<h<iQ*`tgz*SIn<O%~gjO`bX9<ZzwE+bDl1R8xpnQVHMw@Gc
zIhK!Q^;`~RSY~C-4Qb;K5SQzt=z;Y^mOjn2W4<<^ldAThDw!84u9sN<x;o6{%w0cD
zx+JOo>L}1Y$hA#u+}}O^yxASg&-uZ1@w%=Ium|Bl35e5mnZH?e3)XPO7*m_I|M<&v
zZ~nB~7x<5S<MNufJ$m32(D}4EE5Qb+j?MZDT=?6e!$a_W{<*VM+`}5NlrJY92m!fD
zqmOi+ZO4JD_LHSg;Vm$0fSql@#tV$Qs@P`bX|+8-f@xEyh(O~G*JK`&!~qwKlCIA{
zauo*eLT5f1<zF-CMzXqF8|N}wbys{6(F=mVH(0E3G{mi0G_uj$5@+P;dSWm-&II+#
z)agzrJ;8F>(|*X`J#J^`@>h-Ld9qYWOwW(i%Jzr$#r<+k6oM~HCK2imY+k<{LB-}-
z_c{B`x~xh+Y#>dv!MkPciROvXXw7i<Ltgasa!;y}FXoguA3uC+Y;^CMZG72q@?oq;
zIe%<L2ql73k%R$dLT>Z<XU@c@vv3lKB;tYw2^DWN%Z0o@r;k||+D|Rr(QkAQ7oL_S
zF(70i{1u6Uw=X1WyuAIIwvTe6*5So%If0>tr|!v4*L>G~#->}Ko2qQnyzFZJyG4?f
zcni9A4MVQvYlm|6a(Hq~+Xr4r4|&)BDcfhjG@UKum_jEt=>v5nRqX?up}d19th~*<
z*xZ*8ixtQX;|EQP>cBA^*`}N4-Ro1Q0yvkmJNG_H2WVI`58z1dxCg5xC;qubvR>!l
zkgV5^VYDxYYz-f{d7QPXZgsf0{vzdctDcF33&wcB;sB(+;<3H$#RTV?IFs`Z#v1zM
z(73MG-NSj;!3q5UvtD{nzy%<;rLxD&;{wg()+HqZc1RQ@u?WKW3P$85qs$ju-!&3X
zblz0Y_yNcZMHlfT0Y#T^8V0a>$$u6TOrBP7yqrW?#2GyI+n4TZvi5jzz3+be@XdEW
zf0)TAyg|_H^V$n?V3DHg=-L6;SD(Dt0<nl#!a~6br7;cOehUoTw|S_meSS2a6p-=K
z|Jj0Pf^yLCRJKD-2FUK^U?w~X)f<a4j`$Tg7-5`{$QKcKf${#AzyJQ*kKg{|_g{Yd
z=sMl_se#4$1GKTedRTd%@7x}@f?HIln-*4XQyjs#TivBj2?jKI%IX%Bv;Y?<2qJrF
z;~V4;rrUkyhK+8Xll}geU;ppNzkly~)BO1NkH3HO(@(Bpy#L{wzkmP1xd`z=N=VVp
z!(HfDzArNSZn7og6-;ya;!2lK{tBHM5dvr<jcyNLr9VhK`ZAFrPLePXOeVu+NV-|w
zkA1oAadjLEt+87`S!4!XAI2B#*=vCr&m*Y%_2$pqr1#nSuCAUN{Z($|{TY@WeHjHv
z0^$XYdP#tsha>^gk4@us*O^9AA1QoVUUuaiyL<tiAQ}J8{~M&a`<x$ia`o<Wk=u*E
zB<i;r8o?$C3L{^JBxwDZqV)HNx@%|T5=AdmT_UK{a@(eNc+KAFa?~3SQ2g}c`wxHr
z=yW~0t%02bpVFB`;p;;ws?B4A`O{7pr56@XAz)&U58~qCcz?f7OV{fGLfx*vOm!((
z5@FCVkS3Le&Xb<TMhc6p!a(_wrwQ%T=$<X+RPdO~WsKUQ!32Gc%35sxnrkZsA|wG(
zK*10vYHcMPV}V!%>i3^M{sydBZ+}W(X7a1v3fA=>_mH;T$4wviJ}sJT-Lz@luHmU4
z(ZuY2`>*@h6ApiKa)QJ-WZJ4r-5a)zOjk_(G6b|4gPkM-DuLsS#e#>5ff$8xAfiYH
zmp*lswxeLx<h$li8^jtQ($Gb|3}XrqOx@hPi$d2(`ej+;SrZm^+hTgveVy(w9oZqQ
z)2*Ejm{cLa>h<0hlv^z6Q=cB_jD@C`cucdr&E9P{`?LTPQFljWc*~m46pp?Ok}skG
zOdiVKCl2vARsq6TM3_=Y*mS$52X{%nwVByhLV0syOrF{4()5AV^|QU(@~vPLd3pTg
z6v%nQ*v;x&@FH1_Vu<|BpSJn8!Jh5kun~c*h;jy?01AkR6DphiQ4mua@K^y9Fapj4
zorGZ)828HDim>J!lb*ONtS>_sVLgn=#He)=v}(G|VcVl`1?5H`Ojfb-$<+SIx|L%X
zU<8j%DQ$B1sVQ`c$HO~wDI2DT)iTq0NMfdbY#LjAvrkqZcCWi_*}w6h^r#PMeSdfS
z{8=X?v>WF12k)AP^ni_B4;ETP;7MJ+4dR3*K@9Gcd~(T>SWp&@>@Uh$7{wa!?;f(d
zI(xS5;#(of%Wb}~6D1&{Z&MUU14kM<!#R!V;0%jo3vb>K4H`vwkJ%SIyXI&Qc-|08
zb;#`T##__HlQrt-;t7`Bp|S_2Z;izhx@?d8!@IsKuOEPVvG)#4ednThwaeRlS5~#H
z6zcV1EUN@^yCw34Q}!=uxle0f;NVX31<S6e?!3{}p1^q5v~`y5-z_;ezBSu;g5@DC
zcgMmTCf;WEzO7c9-(~I0>GBQX+#T=lL0Ni6q(O!Ih{_i*Xr}u{AT-x~!<5$P9XjQH
zph3gkHwv{6Y3>VsdJXFt8c)^<>t*>u8Pu%4VCm@M$r?RA>@#otiC(w+f~I2`PnKz*
zj0-g5^BP9wZ~petX)McF=XbgU0?Y;0rGV}8x~}TH++hh9FvQwCvxb|@hgn$jGmJ*4
zPeam?Q$Hr5{x;v{Kc8UOFG*ctc8LIK-PlV%Tw(g}GO!S`?fYtfmzRLzeUUcJ%uTWD
z@1A3sWBS&*BguMG?e}w~Ij)asHnsoy5H?`S?W+1^;a<5ZqFLs>0h;gY^ze}Fvv0wc
zdi=Gg(Tj6t-kkQ9Kg-tNb8GxqwcW64@9uEf{2|iEo=DF5XG|X-)~shBf7WVHW8ZiA
zqs99{Dmh=e%hunZUUj*4<B5`hM3--++RMB#IJGR$o+O;<EZ{+zTXUac^{KB1=DyA{
zEOqINt8&KUiMui^*1O%@9j)7Aa!eu*?7zt>^=_4ub(&msq4GC<dwKF64}7wps+|{0
zV9(9F0T8^bp>wE<yv#a7L4TjW&z^9ctKeIbz`K99&S~N_e`7LHq<)*OwEPJJ@*zEV
z%%L6#`>zQ-P8id#=fx6)^7nt(<6dxl^N-(u_~kcSAG7OY7>c<$_84btm)#1)u?DVi
z>jI?5w%TQ-y`tguVf_8Wzua=>S9LVH*)_fj>PSF`tAt43f$2V!-s_njsl|kmB$RKm
zfgApZ{<{D0j@=P49~ebK#7U?CIu9v@J8*1TF8hr>_wt}v6h`xuU9A|queGp78qUcg
zJVH~T4MPev99wj(2_K$+&JUV*@(S!*t7Cq3*Z|BefMe+#!v1qxRfRo5a+8IyDX<$Y
zgi{Eog>V33BD=(Y(liSTQNDiV?vI~8zwFhjJeoJnTg+Sprz>w0#PW4g7z!g1D;JQl
z*i)RuvReH3zABrxK5lHu8U|A6XFUzcvvy;XNN1F&UvKnq>NGT3fq5Vq7t$;&vQ9$@
zNm!BuiUAYH6x?Mh*ZbJiF9*3L+~^Jat$igGMXEo7CI15+FfQW>0v08sMmY&5EaLJN
zVNB^g><;VZWxvlr;cnJh*+E&{M><x^i4nau26HE9jRmt1lLW{cE`;bWvaWgB8h@i{
z3Jc8Jud0uj0MIgSGn5R239&u~o`9Tj;ZPVTMe+Jy<4PsIIb0sWc}<R<ZpEY_2}(aU
ztsQQx7Wg)Nad*s%twta|Kjgp-hjf#zyI7eetsvHe3ORrRiy)LAohO`AEaY?%(}If_
z&~wH6=(68H8t0}-qg9|-8!{`9K(+!x&@?QTt$+lJa4@dcZ-`>Xg`zCFk~+HL4KGcb
z?d`fE2?-}8h&T;c$hoQHJA*X}XdpYuB1k9?g$fR|A;6QZ0lb#BZt`83wivWB=T{KL
zah0_-$7piGm9kkd1j<^`);PwgVjp#rr-yEv7>k4%Yl1}~kNPOU*(|#ZUCgp!Y*G`9
zDWny~bzeqW&{A=%8VUDVN7H6qJ!N&BZ!;?+ngauIEMfvih=f2IlFXETOpXB-)<P&`
zMQB1Ow&@XJoJ2$z*b9Co#G;`R0<d)n{HURcm@~$dnlw3>nt<Y6Cm!ByvqNJINQOzo
z<Zn~Gr4S6fn8vXT2w>7gH4tgSlK^Nkwtl+|tQDS?nZ*KO47{okL<(#e#RU;E5EfD3
zA9-ykwnB@EQeG8)1)z~J6Ncdm+cbebNkF>9N>NEhtkY;kV8jIBOvx+nTt|)Yc}k02
zotHY1z0dX=Y-XzyS;s?H`nT)SY!T&rTz%iTy9BaL!sG`7K2EsG+dSr2z*pvN8OnN}
zZftNSb-bv7uOdpobBKw|R}^>1s7Mct!D@{?%4FQzKz?fSil>I9i~+2i(Ae3d*{805
zl4gO*tUX&`&8qwDcWnb7_?(wCw9?3Ac)(^Of+*cPFGClTU>F;_d~fur|2<(`nBwj+
z@7tH#g-XCwp%R%KeMyAaq{?YbHZ-tWTIL6q6M<agXdcpfi}gL;c|n$51D%NT?!Kzu
zood{<fi~JG!HOpGx3Y8SYlKG<P|!MZ&Q6vd{;Xs-<(G;mVN5M=2AD{~Mn#!pM#1iy
z6k2?vPrW?r;aKPQFPaB+zf~PDKepY=FuhH8zs&Mp+BDhzuE^?(TmPR;GFQ8wteB9$
z>D%xAI@?#RK5wk+tF@_g<rM#bzbLYG(~AasQ+6IFA-%jB!uFulW6HtoRdoM(NYefN
z*mO;<G|zvJA9`0DwUt?$V%=1mM=-V0ZF*?4nO^mg+DOq5zzhWkhoieqaFKPej8Pbj
z!W@ipu4%@8t$C&#<fLJfq{-7pw=5PW?qq)d?tgN#DM!;#*gW77F$}9m5esAy8CmDi
z?Z*&2b^)?Wj;7`ZU71rDU2h)JvdoJ0p=$C^mTefWP)Jftun)kc=me<Nq1S{u5|Ln`
zWCdg#fJYBsa=0f4ks<ZLYd}8C!3tI(2O7jt9MPCWN?exNQSmqo&^l7I3xEm|u?&?h
z40B~r)0Mjhm?*^B)=WL5Wh`cq(nwlIp+$!nATecNWH~a>?>tB%Mcy(R(J*9W$=WT%
zX9}ENX14+w#?*D2$(j0dBpJsOkt8ID4V(l2w=L{fn}V2z2_ZBIS<qF{Hj@O;Jw_xs
z4ap?w#zug8U&4k%B}>2!s##B$DGWT-rb?_CVeG+1OLy5a=C~1QifXq*i@^%zw$y3!
z!hRa)0*`a%!E6**sDYQ=lc#wp&opvRozr6N(@i~7)AuHLE=s`;<~EzWTdR{)UM78R
zLZ!2bQCFW{Ji;^6>g7fo>^bjx%XvT-d9Ppi$2o;g(#Ji4WX5ri#v7?D%N-BsqQG%Z
z998%^hok6o57sIxx9j_Dv-U()ou#q!h4Rq=^vS3=c{I)!${R`3r6e?Y`Dnj-NfXK$
zrc?H>a+EN%W9f#tl7iTeF(qo>5v4koEw%}@GRlpyxF^eHiJZ`7oLdzGR}#YUoGXb#
z`4)hZ9JDYN8*xq;p>j;G&kfNXb{f*5dICLUh3@#EdlNqLDbJq4^(wL*)`hkv6cYeN
zMUX^c_bP|t<Um-M1YOWienL(J5ll_(qjAE+Kz>3!CL^bjRiZ+YMM3-uL~#U58;z@~
z^dwx@*}sqYFTDMieX>h!yl}x86A4eEgb0P_<iNa$8K$nv$5siR&eBB4zyy2|9>~Dz
ztf`LmCeyaj2819is`B21kQ!trj~FJ?%BcxF4smid>orOe7?)2ox_sbwICFnl{9XTl
z=A#Q@NaGJf4l4mmBVmYPeMKyoDz_;iaWLJ7$_FR*57s>#OvOR9gnBO6wKj1>V3&l<
za2bdwU?Ra1RSd*Q5OSe{p)}?(NG{DLd9LcmtX>1EgY~f1m};Cb8W1k?o-`!g0PDx}
z<oHC$%sKJs%LFE1A!dupU@k)!FvFM`j7=@w5R3gpfvQl98VLlXNR%66Iv}7?f<V0v
zhwPDWcUilBr~s0kX@N2zh~+O+=8{H^Y5_40J4<Q6s+H_BuD`LC3*PAH_sLmNUxuWu
z(~s%b$9jB86Xp7ZDd_;S|KpGZV<0qAEC$duu(!vmTwb5q5C|LP;4%YgGz%mRNr-~+
zv7CN^<`^d&0W+qy$6yhGW|_mq(Lg6crBnwA>15s9HzHBbJ+_nGtCK{Mc$gx-x3x1K
z-Jv#a>?tQ}!H9stc9%K1NMEXBpRn9nMs-ybbGbv;Un+Hf*_Mlqa{6T~%C*`kBoWyC
zb6DaaBB5fb$sFv>PVd=g4$bx12L#NU_$K`9m2|JnB(cH14TPfFVa0foj3jmxM+uM2
z8r6zLP-ems&u~<fP_XlviUse;g(i-&du$_aGJ0$}C`^d{mZ$^;3>SE+FV(1I1)ecu
zu>g0cdzIY}`ASyE&<;^99_ev_JqljY_=@}rd?|uHc-X(1`~b}?S|*@z7{v0{$)2*Z
z?ZT{hs=QR(jS4bw(~iD8sr}*mF_S`okDJxn>Si%rfz)jlJs_6E3Rhh2qgg<lm|=J|
zxuhY?m?R>YMG?ked$I9lw0H%q$H5ScBbX!<^20`<ohx)P0tN&DKP}X&Kw}gp`*g@Q
zZQ9P=L|_=x02LD9?JRs%@T%!XLC3bTH_JsR!dSgM7s2AhL8ycdFxeE7<1KmbWRfLr
zx?MKS5eGshAz^C03BqB0q6ymq<qkl+`>NijEoL1%zEM*jORp|r4a{{&H;?H~mm&Pn
zwg(VN^^<$r9g4KYh3wOR)?G-*a`~F7g#i?W#PN=^;`!19tP!H#OQ$gidffCQrn*n_
z0xv1so9CG1@E4YYF+M*U=dbGCqj`F1NOBGOF&RPHJ`BlMx1L#jcC;*Sf?#|BK2(_8
zRDD4+i}tEDr+6QE638fWv#4*@_xUF*!*0EB##baF3Enl2lm5o}Mfs`Bh*4=K>tFyC
zL`<#bgHdA^(Qz!jS@#thxAuF)Bs7`;pqUBfiLw_&40io!FTk&fWD*blGbA$ChzeOe
z-kzYm6ZQP08w-NT<@D=(DkgNthUH}TX|&5Ju%1smk!#o(LL2bMs$1)PkEhDp{Qlmu
z^{l10L=>q~k5C$nT)2pkU=$7h)XvRn3gzKG47h5FUxt+3j$>nk-x!yheya9a0tQA2
zwQ2ubD3DQ=0dQtxa05mEtvE5l{*XHR55z*qLMpRTc}NfWS`OSCisMc$8*!<cFk5@w
zQiDJ-Drmrnh-K$S8j@-d^kdWOIJcN4;VVwC+6NT`jc<99NIt_|>MKOa*gV;$ZK|R3
zj0<s6uBKaH`EmcwByfM~KKggVC*P-y?nJrH4zTi;ciwG}U5`TW^1uUr*Sj~MXAY&M
z9S1@Gi%YMDRRj+!j<{SKNgk4pYx^<9wXve>?uj=?OThH{5QnJ2yG@ZFF39YSsg?!>
zVY4T&Ih2#D%aAM+y0KYQ*3|@ygNGa}CIS12bJass#IfK4cGDax8iNZj*gUHFRlET-
zbf4ed7uEB-=e&Ku|4Q5D9s44b0pS$u4S}1_10F@n$+ZF#%n;G%p<Gf^0t{0sVvT}H
zE7VJAdYEMC5<5c}|CJE>vD8?Qt3x?RJ&c>T*<v~}5G&wgCjqBe?#<|#Pj`$KABA5f
z<BD-QRt$Vv=}uR^YuXeDSN;F&{aKf!%9SpP{-KQq)?x5iwW?I5dsWSl*4}mRdC5Vz
z6A>tJZ~>kfp)t;XKW2c3(_<DZ!M;3_YVXx}=1Tu!_H){7^6cHylZm=$mz?d`?TDHo
znow?<N%uUTMHs;&BxtNwIelMCHpoVmb7q0mtBzIrJ9t?fDu|#$4%P(DD~PY+wZWl;
zEprI0#SD$L^DrsAjz}PcBlR$0?Cv@;Pc;E2enxH?Grkc(BDkp}Ane}q$jC4mJiqDB
zLC6rEkp0vJgOa*llIFLj&A^MF>!kFQ;cU>`IUd1?GLb?#9;*LksS!7zR6*-E)b~E>
zRZrT_EP-wXkb7g)XsVXsodZ%KWF6xGG$G=8T@iqY@Bkt7MM3Lv_q8a~zbWR&riFLk
z_X8?@y~T<KQ4~pku`78dmelL70x~R!>XK+Myg#iUbiI>Gwc=}~;<BfrJS)sN0H1Cz
ze@hiQj|tyAz26_#N21zgs8&|+0KO(~D)d&+PK})@)!)4|_dZZth7)@7MX%tBBK?LY
z2K{ZrQIn|?oCO?mO8tH($^&a_6D{kY`&0B3mr1Raxk}H8_mmZ<uR!Qpe!s?N#albh
z?ytec`Q3YpPhVfk;+CJirr`k%WD^{E7o{KfSIEw<;IMdA070l&oNkrZxV_3e5%6`(
zwj@3yy0=*_&TSdOBHU*z3<na}IJGi9rwZQvwb?EU5IzZ`K!ik@LBfLQw}T{+6c!d6
zND#C1dR4JPnPe)8{RXGY8|>Z^$K5&ooF#9m4!fR;w;BFo5V1^hMa0Gtw-*|<P(HmY
zk^B~C={c^GKYz&Tsf?>vyB~o00bxGTX*KcX@-V|pU2hgYk67T7aq<tSJYB$@WLfKN
zaFDew@N@FGzYVW$Pj#6jURe~%Onz-G5SGZLc`I~XzV|6Vb3o!Ug7=c?bx&w02ag9+
zN8?;swCV1`Z8XdGkueMP!y}PwK9k3gw=LauPQA94bb8g7gKUeg4!s%%cXiEG@l&UD
zZQgW$iS+d5GSqC;I(pgP3vZ{%7zBLeQ7`e;8#k5M*=rukh$>=4g!)X7#qkA0gH3oC
z1_8APyTSbZan9#0kY(-V6xBJjaiLRRvaz+8O!<7pXBjnH)PiL_H)ge@!k>7XPrX9A
zuWf_D?JC(SoG83pCDZzq#lCpAzirp!k=`ZN>&eid)n%MldX(m&&>tQgjN4qwKnAwW
zSO+=o4;3l(ccWqaNDu<`IgrJ^Cj(_trGHb}i&$0aJ^w&D<c&ul=lINH8w@kkH`W#%
zz5AExHlmxYAa?J-=HW@2f68Lp=5ptyFAR|88MSlO{tYh~Thh9FDeuEz{#kjRKVcS>
zH$Xb)|3WU~9M?y<BPp|t7Z0n4wz`cN@H7QS74?*{a@loVTs$R%KVk0Y++#nYZYnJY
z5dqi?B8bZklo)ip#9x#4@j!V)FIS$fQ*bbx_tp*Qx5+lfZK{jcEI!%3L+{^9x%yUw
zLBsWWgma@fTMKiJYT;!UgQGfMNl%_~be|aWJ30!)P3-RotJgBkzv}!74B%=8?VQc?
zeHpIvxa|re25(n{&pBt;8^Bz1m`ll-FyD}|d!cK6J_SSEHj+#XkUfiXepjC<ABUq9
z3pE7ixK={sEo}Qo$MdCgkT<aP1jspKCw2~^U14i@48xMl&S*L3=tBL+Ij-%Jg>#7W
z<4zcc#9{!{xkcW3y~a@ANoR-idcb<hjX|}IVJGK0yf7z(LA+k<`3-H#U?nWZAl}xX
zi*wOi=y$@PUKfZyr?uBE+rXilQ8%D-l=Hglx=yjoRt&N0^R`<Go>ZqKKgW4(A%k4s
zY1D^?xxRQkxLh_o$2SRCdLMn@yni-}Gk&Uy>{fTNswF*l$JvIcrBx{}qAJ0XG~hlD
zLONKezro~rP`*#8?C-_t)Z%i>>h!8YgQ_l56`p>kadCe}KPH<#za?jPly_g(%Aoc1
z+V1!su8vFdU3>fEvXDd!eKrzD45&}Hx>g>!y57pPX!B&<*ZBHVNG1je=d8C8vfWMi
zw*Ld*tbzPt@Oi_0V}LXa%`m`rUC0m2IC8lR4TE$us-5Qj3RBnnZSQd+Wr_mgvw$hn
zG)Qj9hEaNa^g!Ny_8XCJio@QZ@4BDnRbt~99pM7u^dk)VmXvjRQjwZ{aS;TjOOlSi
zNgw<T{fKbJBEo3DW*x16&D<d^CPgSj)UWj?`Ki!%xF0`kuN|Nn$ngI6ufOl_kzU<3
zJ36tY&tA{cMWN%Ii4oxYM<0OipADK6W>IZ3jRew<m@d^&>C1pF-f)~+>N#jUR90UE
z(KfX8Yi_%vIw!e43!SApHThPg`t|=W@ioqqN=G=c-CG$UN{pf~P|i-T;tt6I-d=s_
zj+cv&&`1mqD-s<XhwPJh*GaoO)LZ@Rk-&RORX&iP)7ZS;DTwADWug9JDt^En1zn$<
zLd(*+)*bsJbS5UwF+>mo&hZwBdU@eJ6&B(2?iJ&=OMEJei>6oST0DJ_6RohlKt2p`
zn>2L9<?%O39!PyWK?OmfufD4HHR1Z#%=s=RBVR~4KX5sBc2zg;&U`!^fb^|;%IN5S
z3xpFs^+QSfKT-2h=nsw)x4$h|9wGHj+ddrPT8;M(#zoBAJtzr%6#@8xh=Py=%lns9
zV8sOww=6IhfmG6I1kJ>X9FEVtnM_2AF)DNtRE18VA1%c2D)FHaiTc-jdmr`Gy8Ucf
z*eu%@15S9rwSyJ9rN^fKX$~G!W+)mqeJ&Et$n(3S-UeTHC*0qXvM_g2L<K)8jb>5f
zt_TU2C^e1GXT4PS*&-ez-@ZSnk#t$y==FW3Ul62JX?+;1HvWw*#zNzt?}y8hMQo4r
z?u2hr6N!{osrW{!|AIxbZ#d=p*Ub4G7OKcb@_EDQrTJ@8rnP?DD@yO_X8G{5zmYGK
zYZA|$n9q}!wil;(e%2Mk_BTGt+!iwcq3#$D1yS*t(hvDte}+i=_<p!+1J#7;j_?8*
zzAc0xrtlJ1U%elKb@x{oBdE^bvhw0j4WwU+Qg@jDlBHKmLMoPris8yCDwYSU5J$?>
z`)B}Be`X4Ci-0?!n|u>dIc-FBUdxpdu)gGr&zKP9#t5HJYt~$h^AxB0_Tt4=e^H!y
z0v0GiSCN2>bo->RD89}Hn}H-!#TKjBET_kI57eg!En@Y<sb`yo9S+bk!QLHUq2GF1
zt<?|NdT6Fhs=6p`C*5`*=!x_666^8Lm-Kl=RG^@xhpH&kmo#r@%abg*BsK?wc2AQ&
z$T^i!Omcp-<2V0m(|mkn&iQ~zfbgmB077GAbes<mPW8f^h6iXyag9%D{q8AAI~S*0
zYh5g@%mFY>%nV2(XGBpDtOJF1S=TbQfw&;2{saT-ssRF#LzAEk1gdFd2F3iQVuMqf
znMH+B+j@HWrMNUYo%~W<-<_9Z43N33Wlg#u0v=E<n6E;qkdl7O<Bxfdc+sa*m7>k{
zK=f4eeq;x;-C+vPal=D9q}3iixKr5Ex11|4)^Lk5H$R(9my1VCGzG+ddEx$1zj)Mq
z_FM3+_i4DtXCRF~9AvXwN*RyK10kAkU4!U82dUDFp2PgGKxnS(B~e1wMp38`mr3Y6
zCRwGPBXq-WBER#wiWWot3=?o=#QSyJ@l(v`YvvpQ_X8DjGCDD2v%a-&;>w~q05UTs
z=D0!545U#kAgPMWLq<g?BHlM98~c%FDNUnLFIuvPx)m23g7QzzwfcW4Zcmwcm!|Ja
z77!wR-QDUl%DKgkskv7NA~_?0TtN3{T@3Wi=l9)$GqJ{pBAhZ82x3>`y+00vHK_N=
z_)l5(=lVTM^gsM!6*Q{=M(C&ZK!k*;_=N?L1vM9TvXMy6*qpL~>b>5S<%z2*Dcv{I
zn{pfl-Wmz<r1B5#EZ#2-O(AhMOP|oVY@pIcMZTl-`Wf3c&PyQ_um2^kUX!!MBj^6h
zOxgwHO{G*%XJ_&I_&y~@W;YBbY6Z+T-a(+H^DJ~-8bQdo%4+u-GlggSe#oS<vVr83
z`Ff?eCB|v7T$iWBV0luSWalcW|G9_N4kHT{G)^KBG7{2Y5#eN{b{-+2p}&|M{MW5k
zSZ#Vgb|>I8yE1PlJQm%b((_9KMZ0z3+u8zppxm{LwY`IID0ly<JXLt+WyXtGI^$z8
z{vjXP7d(hlPvTsUr>X)?!G9|Y6?I{&^F$D#nB1wd#Z7e=4E}kjhbMm%HO8V~YXg5C
z`NL!I)Eh&Qa2o03k#Ooqph!4X5<C)4GA2}rs7#(Db$A3EXC_ee>z*5JOIy1y#hk%t
zvl8AdJXjK1)YA`IB`SrI*N`)&BwiAmWnHsvssRl+q5WPlJ&ZKdMU&=rQs%Lq7l^aD
zE}Qh6Hpfq%$|U~k`Nq4a{L!jWxj;A`aVmY@AK>kM^k@a?KI^ZdjPrBsRoD2Gz+jq?
zi{V1E3kck>69L#7Pa*Lc$0%-i>KM~&nk#yJe@*M;=dm5IG(%8;Q=xl!-<tKq@kyVw
zeTwyZ;^#Qa^oRothnLCdn7`%}{JHq;n5<u4FACh_uB>5G@=}b+W#BXQzdn%1M-L#~
zXC^=l8jlY|v))_$<AHoH<E!_}|L6bfnXeHbN=_odNg#Y7X~dQWB<I$a2SP|LheAVG
zNCY1o3wn)PH{dmXz;6HhNTin*{P&=&qU%00LbpXWXTW~QNrcY>n-?-8UhXVutvk}5
z$aYAa2}!uhMel!IBN~x%46XfWNHj9sj;mv#fBMhvLj502E&4II^lFc?$hva}wGuZy
zq!U-(|MfqAhCy1^SsQ6|;rF#nyhaoagP~(c*$;P(i!zbk*ESE04xlmhtI;+zuKu8K
z0xeH&bs1+~d9yn%0KnM|(F>@)J`+g7WJ{mLy>z3N!8w3TYRe*`DQBx%U-gaa>XxDj
zT?@^Mt9uiz@n28zYyF85$nIoY@DvEloO2QgB(v}oFmPv09s-jWj0r+8u;9TAc)GhA
zThLkrs?ACoe8hy{C+0nvV<la5UI@m+%m^bOo%3Y~xF+HT9ALsY(*?({&d=R_!lI@k
zc!dx7PcGN`-6jkPmaBtvr26=%2dVvRX%*o{C7A~OWiK|Bni(kixS{j|8|rMq`|;Fi
zApP>^4wAy=lvCzUo;!2O=GE>9p_%2-@zP=&8#`AhBaAysG60>dn;o3Vv?GQ!fd2R|
z|Ljpu@5zblTIX6HFO%kDYzJJN(@>LJSzOic@)S7rXU28$vtcx8Dm)0N5#QnP{_<zL
z+S36`VRh<#ipvCUTWuT3$M40h_Vm@)s_Mn{#+}T^z`P{+t=U&-*MGbFzWG-4XyaeY
zq-n+lTuR+qp0{h3p7hp|%TsbjyT!0UM+|^^k42fDE!TmdXfhDi8DovX;q)ahO5JW%
z=nX%mGB~H#G}EWDn)VAsT24))^D7)yq;$^s83*kgQ%_6&{n!66?h!dmP4YY`n-egI
z8Zk#VAb4wz7zpOn*<r}u{dw)2mTiw^oaqBFSCyT-l=1b|tLoT#L*Owc(H1(0A)hL{
zBS{#36aSqcAr&-~GNh3o^b7aV`nSyXI1^t+WN-xHc0I>+@}J4~-xvMm=<7vbK5Dz<
zOLZA8BF5ODQ1tld0jv9L8`e5gxZVNnGpP^}7DjX>3m-pR&7fk6sS)L38<m0j?GEkx
zllcxr8pu%JTnwVX7o7Eliub|HtU#QrR_NOt>Ti88A0rYoBZ)q>*{tOYMK>kMG?Gzd
zb!c)9sw9N_gEOKZT>=f<s;f-q$#?r;cz3c6C}-qGQOM_7Abn~%)=UK>0T)6cqWWJJ
z44fhyRT%ity5B$Q&+|5)^$`(iPM$--tegG=z*vlTA4?ew!LeO(a4aI{(nBL8>50&I
zMa-S=0lW&)$V1Jya~vx@&cXEc%Ds|@pp?Oo;=YnQ=M{lcDY!V08m|~R*y1<`(^qom
zV2EYvb*w16CXdSgaxcxj??rj;I#W;atx^f0F0npm#dqh0wZ32p%hKuYHzR!NTS7YG
zl(+e^yhGraC(QdZtd5_C`zz9u?G=~(<=nTG^8>g@Eq1pZpmqV2h!e|v=wJ#V$`A&b
zKFXj?*|Sb;S``if*Y?RY?imM|`U)U4noRe?wH{2e;^O|+JTDpnJ7q~+dMcudkwk0_
z9EOGtY^!s64J03gK>ZLDz!&y|bm#oapQ@{ODb7iAeO;RfE$?s<-;$+Akub}*lq2j`
zd5N?8t7U7%8Uk8(EbZT@;#12N@P{O27FxPLoR2W<qv~M0rB116!~zl#8A%rU(V*jI
zcwBRGkZKmBp5LWnz(;1A>mT48EmD2=#@2Z(HmF5_u+a8E#F6SalNEtbjR2NN2x2YJ
z{Mq;rIOZ>-`wNjx@f#yfR7`<lC&4Pi`FLeG>$4pDLt+;B;sJ&nuue&A>y$^j<hYqu
zic2)xwEnUJ5c*l%?>WFOAXT-@vT5fNA4XZCi8Ab;DiW-koNw9bbZ`KVKq1REkwYq}
zSnv20=^cOl(FemLuK8^D{*c(#9d_dB_?w6yGO2!dC`dp_*#8>2@ilWZCF)Z}Led{{
z(&^qO_7Choef4A+)a{O_DxT|qf4{yamJW7*QqAzt^{mnyv0P)S%Q($+6xUy{3)6kL
zjt-(*a~7hxUv`e~rywG>9J*$4lS<Fc<64Xa9h}i(#9!9Mw}T6~AdqZsLmz+!skO{z
z2IdIbSf=s&LwZT_q)boVb9_m&cb((pF9}?GjdgYpn0_7HcJ5x-Em|7@Tk?+}5T19l
zcx^t|T)IbN@pOBzo5iRIk6cNaRCsG?t#>#aAy>AQ>!Ue22?_wDA1kage+xW9o}i)t
zyoSAXI|V>7yui}7S?^#f0r1TI)7s>ln9l@{I47YWMkJuY;w!n?7ZL80NcLCXHJf+!
z3*KCD3#?rO&+mgtFrL)`t80NY0#3h4{ntTAqfmWK5C-9LH_T`CT)%5p^?Q~e&9GLl
z@wxc!<%Rc@-OL~64`{Tw6nW7;L3~fo^{aP^)t?STxpq<X$A0K*ac$;3uD9ydtJH4+
z>KN0Km*&ky(Nh^Kd^l7*#n-fsv-EFCcLuA8E1MIURc&=(Vt=f?26-?e-|GWt&T|yE
z9PE0?B|Y~*wk?*;KgUm5@`*;?11#f5Q>6lT{_M4m-FqyT3^+*lUfY?b>2_bP`<cgO
z1a7;YyF4p|if|3Q7TTlD+|nEg^_7zNjQEkD@&`mZjD`KB?9Y0=c$%km8fQQ}?inE6
zq~yKYbt&x+aA+iTy%5NP|K(QI>2s<b^XJ;l4{$Q;AtQ!gX+lO%Zx~V0V)5(^r%b`X
z+PH1!>eKf%Xnt@`d$bIkUy!c1bX8m(i2up_zVi{umi_*x{i&7eLwNZ)(I>Q;<16}1
z6%IU|^=adR!$lRqXak~6w9ZcQ<Rz}tZ;4mv4^-}llQA2qD~8k4lJ|#N=gdX<pK11|
zRw8XPf!!%;6uxfi%-)gfW+IKjbHf<Iy~3Mie;BdOlJmnrH&=Xe?qb$GAcn5=DvVdn
z;!-)BW<?K<ntXQW83OSzv|~2(cmIZA{zib|q~{AaAS^Zw9x+I{Rcyi_>Lf?Nfi-?A
z#Xz<hZ97k0){2N2PGz-{=sc#ec#*^q$>rBw41A{-?>Wx0r}*^Mdnz)khe=<-3Me6g
z&sD}Jf~B#-8FlG>^nvdFnJGFW0`3HH_)YwGVZd1w3K2=6$lm{wjnsGUlCF+<6mB~3
z{pF>aX+b-wn4l~&@06vzu+Q~@-PiPdPW0Nk>#g>l)696Bdw*#21lv0OD<UEkgPAW0
z<B@q`WA?r-CsCvXY4X0=S+wHXzH~O<Zzb*fQ}2@Gw=At{{h~eHKj@mbPq(^OlshNS
z@hz*pI<1i;uTu(5KD`VE2G=@IH#9@VNiqs#NLAdVUAp<h`uyo>L4%N+^K=6plR@Yc
zE=U-0g}{7s#Vj~Mgdn89xuP*`t(7~cm40<Q<M7qQsJO;BZ;ee%-QFg7z}j*g2fL=5
z32!%a!?9g4;jv@mVghk*3)3<BUiG;aRce=!Nk&4hs3TSKp#E^NM8lbkc5ZtQ*XhF`
zfml}*lNeq7$T~=8p-xw*5Q{{dHfPN)7$TJTvJbIE7hkVQT*mn+`9x-W5XQRc+_0e@
zAu8z(!hk6iA=D50$i!!mHTlT+2{SH}*sD&;RA+W}h6*m2P|1<6+xKbo+vyfCzi+4S
z;ZzImDc0HcsZ5mdsg=HDMQqWNu)D5kQvQ=7<sZ{L`FAUG?T3_vN@x@%Irj%?tXMZR
z^K=ZO(E=ZxV0tP<O{%dFZUG}fNSN?Rs9;5MiNP}!pE+QHG8%<sS^S<Xnwof^vvL~w
zlBv|6{{W?>goU3JKBMa1Arjc5rhXZGzgkw9cPHx_%OL>H8tZjo+}}>GJ7U-V?Kw@d
zvwp&lv-AZC*P`7sk+i*y-xAdz!m7>K^ye^nuARtQP+%m3J4Xg4(KCcRZUw5_Aa{>e
zyM(h!|7NjkBoJJi`$#E=N;U&&p&?RzN}}Q8g8J#yPuaIJ_t*MQgr!m!5(M#ue)ee6
zS<?h~7MuEgy5(b&VkYwDlx!vdcc)!vpr2y(4};c2=etZdG}Se}MZ%ew5XMAAB;{c<
zwQe<Orv4{~CWPqsK{8YNn_}C@!*_<&g~YnePyu^xOOyJ!_LQY3+p$bPAWTKfDk#t<
zezA+da9WS@hy^~G2itUGG~KzzvxIx2`}be}<B$K<)O7zfYjVjiS^Sh_wp)gF$Jv?Y
zd)#N+4zxSIYZjl9*CIRX#xxy6*L9gH(3Ua&?l{#S@jrSZ?!S}rq__=+Zb=#~cc~nt
z)1NWfNA!JlR=Zs@_wfc?HGNE2NIR|m^eDhl##`rbjRn8x>xj)nDU1c5q)gW``KDCo
zU%H1T7@+sI@!uEa<zH^Pf9_97m7Z^L_GjJT3Dkw(<9e$^=9{H<r(%_*+Q(euvt9e#
zQAE>PaxQMoP_TV8wtrJ+_ki8twC)7hpS>Tg9YZ6Y=I7)M&3YSnYuDP+aa*N+=@rNn
z8bsZ$AwFkCTx$!XHKi#Hdu5Wv@5K!*Xk1UQfFS0@eMSy$#ZetUJ!xjQK-1^aW^LK-
z3vcwh$))&)794ibYntbJ7e-bnXICb-3JvC?0G8AZ*4O%CIn%W}#xg#q#g_(3a{h9D
zS0AS*FpT$NSi@*NCGgS=g`;`pE<mhbZ<nWLbSi#IGpn5n`%k&HigSwdyif$yhbyZZ
zuB0=NNib|(($_rHrkB`u7sdW8{&-COo~mTI2`11Wu4Q=;OkVByhCq0)Ep<z_+FS+9
z9yW%sGm0t#yDC?h*IxGlj!oQ5pPi3Gc2@fn-61Yt2VCb-n^A-FG2wZ>g3#^5@bwCu
zShDvqdQc_Gw&-baWn<F3wyDk?`aE^5lH0jxr|N;kunD*Bkzi8}G4EPoDrJnQN*yCY
zeI^L|?I~y&3}#{*QPZxjg<0gEadwA>g)p*ba|G>xm}(_11qlKS-g1zn?Sb}NTBYM;
z69VZ%D(6}lCj@-@dMdI4DJ<Qzd#-7?R7$tJE^=I$a8A0==5{^DH4r8H8Autws5Ioe
zg%{bo2Hc`6llWZZ*}IAhFBiCUxZju7HXCNibFGxd@}$b{vDU=!e9#q!-yiz&`P#y9
zI$b7uA&}DPrX9#`INE`mc`i;j%LeD&`K>Y(l{7UyHpMydfZmWF51_@Zwp*)ukRpGJ
zvzx7M?4B{T(5|t{=e%345>71LU5XpbZ=^Yc7~nu`qe9*6>J{bL_FelZAsp$4^J2oN
zray}LjmqZxZ!CQj;FM{8_wqs+zP4thyj_uf18msqdb&<uy)>`VGg`RN6<Qx#1ocLm
zK@+xXb?$gRY!!A5>b}`cd*Ft}b$QEAG2Vl5TTOaOo{KW^J_=1ZS~6IGWV?OqC_X<j
zk!Ifz7KbYpL7!f|el@-IEp2*&^s2Mb_2Zh^em{yq>IZ=A?(cavm4ggjn`?x_exuj8
zY}Vtx+io{Ftm~+AA#q+c>lk3@xM7_k?4MaL1s1!TMH`Jk+Lk=_rslV_y2W}R`Ke64
zw{qD=IXGU#w4#a8>N9J>Ay|FyU}iY>X43wKroe*>@vf<LjjO7eF6hU8-30pSRsx=#
z_$W?yGcZ<j=MJ8_?~5@fZ=etg+%tq7J-ahzFcP{{E#zR7T<;lm?(yzBU~W&B6tHFa
ztYofKe-hNo@$%aZgv2dP>pPdV`9b}<(C49UKubbaPAs74#bPW2;^;ogTJfzex=<SH
z0oJIG6+)k9V=)}9UUI|&2;)a}5Uf{pb>zi0xYde+Yj7XxYroWBe;c@Tj>P#)i`lvb
z=jv*_It7E>hJ8^G&ZNucEIGbA36uO(oZIya6&lHW+wE}sldF4}8#F7NbXg(uI;#z1
zsFz!2ocE<{ypTW$pUHAF=k|KZ-<eQwf2a2m{2^A#7dG}lU^5zcacy4|YhM!G9Mdjw
zX$o0YWwW3EcshbTy5C=GESivax6Sv~tmbb>S&?tCwQB!Bz##d?c%E4@!mio*xTF@B
zW%2zpKH|9M)Zq&{j{jd&RtPsXW8RRuwP)9)IX5gO`v_d??skJQhWxGf$)aSG4Zj;x
z*gjV(GiW*4byUa8>f?gzLB54bhHG6hcrJGhab@rfCx&SOHUq<HUKgL;RONVl*fpzd
z+KZeUot|8R4iT*N=|H%^s=hrx>o&?ub5dFFgaUf+-^c;B1aSZGe|vETMi8;QY}_@A
zpRzdr+Qy4OkC@%dZ-4*Y;{e=CeD$7gw#^88JC^Mwz!*eDT-!J80mWQ%+2sO=Bpg16
zw0&bL3bTD_cd&9~vESFVzO02e5IkRB)(&A6HwUs^GudLg9V3*uYxF1Ddyb07)<?8m
zb9|w(+j(Kphg(&)c9qLD7q@5TFiIn>Ml{5Oi?3G$F4qtZ#)+M)?0WVNp~KUYDXtm2
zy5AS+{b~EItZP!<dt~ZT#R83){>1IXqio>Pnj`mBr0q*77@^<1FM%*KD|blTTj{xF
zMi5l<EmpX>YnicJ&~jj2zV_PW`nhv`i!MZRzOh=>wRc<Z?Ll&Ft9OARbY?SBa9$TQ
zU#W$}`Q_eK2(}ya07Kwhm}iH;X0RX@0_V(X83<hcT~Vhpu56n~4+^X278JYofb%nH
z7*sR3x8Rz5MyHEigS41fgHY$~3sM;Vd3`wm21e6ITMV@GFHi2vH|mf0A02!BcT%39
zwkU5LGj<JcY4-z!nVIiPf`B&P1>%~UTgN?I*FzTeQaG=At?V>%j&1u^6of*oFYI=$
z7)Ape7#_CElCJUjY`tyC!EuGj3Tg;x+&n7pS|AOMZb6iXeYlm8c5T6~J>E*;!?|ZM
z-8cxr_I?JZCj|A*lvJrX&|Ag&l3fh@-SPZ;nKng{b6R$qlgIU~j4k&N`U+@32?>1e
zM?wT_A+MY9hP{tI@ZLY0Rz`-!kha#K`+;okYVQyBBbh3T@0D(GFb}==2iLyHKiRDr
zI*P$<VXh6xEK@zl5S<gSUCY##U%i*4xFmIHF(3$~!5IABpeP2&X3^EFiW$E*lL@7D
z4DQO}U|_o+So!Ts2@jxSSC%MMXptp#ZB5OHs<>2Ay+|wwsR+%Zig|>-PpRb7s3NVC
zi}w_tzUn5}{QQ~mgagcxX#nKha+=AgbC|u7K>L2G{(vmWU#vF;?T*y9Iq1rS$_tg^
zsCZlk7Rkaq7M*#_xy7=E3%S>#SPX=|b>GGA%xt?$Kk){7kb3qiO_)w@P9J^>)8-tc
zk@Izqa#IYQBV3KBouivKG0tJF#im=}b_z>}-$Z}M)#thr77_JNOa^@#`0L-pxri8J
z!=f7JQUw0MW9qi^$B+8)`FAZs+JRnU%cpf3$dCn+1d;kC&iZv}zEKAZ6%|Af4j?n-
z_SE0{<<v5{Cdx{rxfka}{(dQLRd>w5lz&7r5^`NmmA({$^xZ037p_^5T$d_`R~y^Z
zQBg39uT|QIGyg!bftZreCxrNch=Py=%R^%`+msg&OCjZNc`n%>lJ=+*LZX$WrvP7*
z`0PCw1?+S-02<3E7=(=&P?hRI@zQet>i&>6>;?eI%#(S*#SI5s4f(4cnNp7al$?{c
z#h@y(TWz!b-RF^t%mU)GfT>7r@MucbQT9H1#Aw}TwkXX~)P0~%zKKvmh5oi63RPso
ze|T&*A2x2qHhV{mDu~7blbl}?uXuj05{tJu9t504Do>D1<w9I6qM9}U%%W1im9TJz
zakmRvxZk$pos!J9n0KsLK_F_!<YJW^l{f1<@s1?l1ezQ1cWo(rW}A^Aq~0b#_s_q(
z65X|%sj$C3wmU8FOZoo2ZQ%Ynz&Te5?&E-&^-Qio4JZU5ORasl4+!dA13=_j1qVUC
zRZHfYd;=Hd8q8w!;~JPxdOBIZ)vI6xBPzlX3Jlf%vOI1`)z|Z3Zhil#KW^B3Hc0o)
z4><1*<}u>@ibNsH>g4{2hyWrFvGp)}BT`YRZm~aq7)i?q+GBOjJ^#?e`#F76%p1=+
zK|u3~Md`>5om`{Z)IQe&zX=de(p-~lUea8n0L?%$zZ#GTgK4%0IghpOu1&)rZowdr
z#naodymGHx7Nr#@c>yFS45=nSIo&|TTuXJDS4mmxe(;Y&oy~|8)_b>4L-XD>U#LG-
z5}y%266zlo2fxkG5biS;_8&vq>WQ9G_RjBlJ7W#kuS0zQBc9VG*iRjJ-k-5d;z2UE
z^GBdDw_FE|m|x@kzrH197GM9AT;mk(<gm}+nyvJ$-gYU?Z%MC?Xmg4zA1Q@T!YB|S
zVNzutLG;@VEs5l$`FiyD(9O%?=)^th`Bj7cZ><ym{Fu~$<FVz7`4L-(zNJ;#EPT;k
z>S=~{&RM+WOPvGUh)A5{^9h`r@12x-imL?i?6w}#)O~`jqqW@bvA<utHmxpp&-+J+
z8e9ZmGh48Ggmfyh_KsE8m#f78-8;osyWZggGCs@7n6lAKkDEy;l_~|R>NuXZSx`sc
z52;lk=bUOoV79~EyTf})<GlV;Yt`_ylv+O99svnzkcCR~BFyf&!Cc6LCsQm$gVZ+V
zwVBl??b!azz2&!R@*W9i&e})7mXx_(NvczWG;fNjU{I?%Rv=%>^bEJE(r0kvRWC`N
zl+9IRyue5c+2~-1b4)&qfY3B*7(X?mX8OETYJD~MfTBn9>e5y`fS+ABQW2peT1T(P
ze1%>)Qq@I?l!e}pL1+$7)_pri*Tw+aO?~EI)9!VTf!JYaLQAnKY4^#&xlm#mW*+cH
znlx9b>+|sP5!P$bj4#Cyw|;HSGO5{}Xt(^SOyaLi)Z459t-Qb9(()@B4V$?954pZz
z@C#fNhqj`^JhMM2e!G^*bN9@W=HKEhJ;$He8{nu2j)Bc6J$26Qtp+6L0DWqCAo~b^
zZ$4GFf3e1=aN*hj5|#wHN5d@pJWwn?0OgQ&gssIl7;OEh!L&Xo*7v#Uy1*-QF!S!x
zgZS#bw)flHBZRsLj`jAx$yw(R)mNa&SvM{;dUg54dXNJwvQd`+2G+cIvb~zHe?wOB
z9j!>e^`_<=V7C_SKe}_jI4v`Sa2umDc3|C{b8h9m3_~4zO`A;@4<fv!7c1x7&EoPU
z!5kkkX%NRiI%u8&u^|L%sA}WEz_}BkaNR|-is{^34EpE*(3sCp?cYMW{dVG<V7T$&
zU=$8R13%Iv9k}NDk-z!Z>ND#_k02n@qf>l7PkT8ayLARbs_yAF|2FL0KQg%XY5k_u
z6<NyU6lW(ifD8Tb&P8nS9*jXMquQBs!Wj%RVvrN?D8*(^q;u}B*c0d23|<W|*t|M-
zxkbkPTMsE*C*3JaPhY(}iOb)%Q~co3OXnIfm^pTiX0f;p(bKm&X$&G<6lumF%^Snj
zIH<U492XkB7~K2kYEwK0#5KM;7rFsUoue@sBm^mR+aB=R-`=hduR7=L@JZb{9G}41
zGJQg?NmT}~6_~DIdH53p-{Lru^K@YG-PpNGOdCuvcxjTYI47RXVPT9yxO0$$?QqUp
z&e!%3x-NuUjHzO%>>#tkfV4Vpi2>0p0C2Cj1Sw}QeJ^zm)NHAvbC}8m*6AtEx{9xT
zK~+HuC?SE*{YVH6;RE5|u<kU1>V5Qq@cx+%LL+V79cGj8H@m&sSf#4pt?R41-&5{C
z7h14*Z&;UGR;Sl#6+jmi(MY(#=bwa@&SB0=qDvN!zllo8BNd#5Tp3_xh5NQwZrI+r
zqjl<2$!I^$yPp7k{Iru_YLmumQKd~B^U>jJ%E;Z%`l@X0s^2o}%4?^E??I|DL`p&x
zOcOs4Q4kUpS}(==Gd*()mujVua)!>E#557V{VA&Rw%-@0TlFUuKK!ETiv_Scl|`2Q
zDfyPf*+1Xv+G4_T|Et7JPo#?bvo7*~RbQSBOUkZQ#sDG&pFh;5d2oMC+smjndx&<2
zXg#90{~=O~wH&*X=a!dAe0pu-ln-v|wDaj^`EGWcur)T?uH1J3Q!RTs4zj^dartm(
zx9d4ZiVT_rxY-txWOtAjM-}&X6(1t^=Dk}!IPQ*Zi+C6)Z4Mnf4NEY{wQA!ayqAH?
zhcJI1IIB87eYFWm2$2Doz6e9ggkt4F^4P<%3a$HWB8K<Fo;}^o;`gM~D*XZ8il%}P
zUBY6aF6vS718AxrFDCt;AK+RG1j=?D!(c(PK2wSiB0%6Y3sPNsmlca+<XrYPJA)9_
zHL(neLPqZHxXREV1jLC<2X@XiS3l#~HZbq*)Ygh=uIah%a9yLb*$;ATRRzLprTKH3
zr*-nD<a8@5>xCr;T;*NF=lXi_3N+WZjP3h;c_<_Gr;vzHpNVA`W!MZvco-^!IMed}
znx4-I(k{b+lj^$OA2BBmPOIB#&e)03l62?k7dUCNSunjn7Z>S-!N!S&{kL0OB6S@N
z4%j<Kvqdfpral5i9nN~Cbq;!*T5Pxk40;Y^5CxLu)`SCDIwy6`?eM)q{m7zDMP4g`
zvuqn<OhiOd9xDFIz@npjzBy30hYy+qO>k}zb7zQF6Ain!hjo7SVLZyDO8*AePq_)x
zIU()uwI9@8M?#gOlTZn>6h7gyZybJ1d)-r3oW9QV)-{Eena^#O>>u=c9)By+vo4;Z
zJ!SgDa^hqE5|QoRjr}WVwpT6or;)|^f!)EBNfy`Xx1?Peq3_ImPi+N#caTqI+v|PG
z^gN<v5%K_j+9KNhMa3r;BDOyoi-Xe#*aNgD;w=?)Z6d5!9`8=EMSI|$R6wm*10#T8
zmloqG=a0REP|CR&SuA)x!h8cYHCSI6$7@SI7LjvVwm9K-02s?jg#(OqPt{#NyxyP1
zZh32{d#BuB-mPsOEg%R6(TFe*GYCW`q;stg16gwp#$qeyv6O+3C!fIWE%&Kqta88#
zvDY%qzj}4yJ*PF?$q|+QmbYe|<Zq}(9k5*3V&G=~TO>Y%dqLggqw|GuHcN%~UxW2A
zXV$qwO*E@<n*D{$wk7Wf>x#7e4Qs8j^`gy#&6INjeXKKTj+N;O?0a#;+V=%#)kjw9
zGph&=5Hq|bc<rdhKiwAy{<D4%ui(yhB<Hjpg=mIOi*_mFRWsLaB;sJhk3qam2aaKb
z+jzg5Ka8LCRgv}y1&o|FT~PZ|tyK$j9|3^Iym9A<fYtWa^X`zeP1PIXwP9$LuUiUt
zPEKVKS9o_|sCgH`!FOPcIJ*Bq0)})Vbt}$r4p1*T*EbLKKE!s7=zV+@@PbHV^{dzP
z*)G7{UFK%F48-ImZ;8RxylA(KxAwOknLaCumbVk)z5BrpW(-J|xcuuaNxVlTxoPKU
zBVQyzGzE%5R-5@qN3H~pWCY3kD$@_-C9D_W98sA;ibWIy(4xt$nk0tS8GBIYEMAD<
zFqpkvig8ZA4NjYD^AXv;1)AM?Ymw+XXR^&i{}EQ%rtr7-#a`>Z#`_Dp$r}s?(vJ%W
zT}d1_(_ih0!GJi>3p4)it{fEZ3G0-_muqtN%Es7!Vs$2xPsPw;oBd-)^bo+6L#&rY
z9Gu!X4~9(qfcv<^cC+37bTfXB2N607Ta3Zr=c;pZPB6o#8AmuLTPp&|{2&rRM196p
zkn_X0R`h=QnH?1$6T6R9OUX5hPs#Z+%DMa0)2X;91N?TsMW*lGj1RnT%@a`O`;iPH
z!Z;7<4}chwaCQyBl%g=hV^fUHZWA1UzCc@bu}LyeluPRDn!^T~Y(&w$)!7%8{?{ds
zv4HBUBy($#Z1ao*ri{%ihX;T`dOo#&eLFbA0U(fNW%ciL5hYZAr$s3UFk?Sh>j4Oa
zH?d{2-11m7E(tXGCc>DE{D4RyD3>y%J7fyxqIzuF;u=ix{9GmVACu?WYya`r;_5vW
z<vA%W8=!WdcsGOUep3L_+5%y2ferwJwv)q5qMR?nuyy^%B63cizKlbG!QhpEvPVFI
z6F*f&cB>QJUecWn&=&;E6YKq(4rU-`wRz9n{s6zH`MLOhFUp;C7Z_5vSDw7IRj~FI
z>RP}xbvH+OJMuL<K5ONI;{2@KP+b=nAX+ZSqGi@~pw4_8AU&u0Dy06WsxH$L(mSN0
z1{4~kPKq@~{`HoY<}XnPP%c1f2QW4&AU1Hr%VF3RR3A4(z3R0nYpXM^PC^+C(59>Y
z0Eh}&m7bFigo)+F@BP`GsciKUmoJKpN~^nn!jVQ_AobTT2pyEjwE!D4{aRnLuKv(^
zIJ|Jx7_W2Q_ZF;<Z8ioi)$c)rbdAsL8pF2V;^*L|b8PD-8H2MMzRfueC&7MlZdzAP
zMXr*zIL&PvR}R)+=L8%$UJL?#jPw?d_F7O|yb#=DfHRBmF|wpVA`DBuQRaa`x(}RL
zlD{ZFS3G-p^5O-}|9~vbb|DZatllmiVaRAl$F^Ho+075!Rydg-=nJd*ZV>Thv^bDv
zc=?v{hy^}bDiC7KnG7nZ7|dLIbwJeK)|mj7+>8PU=M>%6-K`_bd#ml~HO<c2pA6IY
zewi3dg|^>jF(h;`Va6b%4db2bkyQ$agLW7N;YO9K_TG8Krg-&JG1oc4mMgL2M{W#L
zWR4e+`+%ADdg~1s)7Mj446p+egaOH>mjwgy$CP1LY<^DP^f{!aul5tY2MTCF2?>0z
zv`7R?O@K3pk$N9};Jts=XF9hno9+(DoP=AJ@>uFQLNi&GK$X1>)K`#Z1R@H4__BoV
zh38acS$wUMndwzxJ8QH1oJVrG*6-cQ#V5NR+Ph;T7IRVufU!+7)t^DBl5R;O87Z+_
zu&F%*x(Z1W<?ADA$U6w(A{Nug`;*J(y<socP3AsFn!w>mqY@l$RD#=XaX1u_bLnAl
z@v+aL+NT-Fgze`BUk~1{2tuF$X-|Y=0Z;?Ja?)_@Lfl#bHRVs>j5NVpHfg=D=>XgK
z(;l}wV%a8KZ<|leN2QMNVsK3mfcvts&e!=2YJCnzih~BU0Tdn(NKkL4gIo-RK!{7T
zpfXmx5ftlH*8e!X216SVc2UbF)q{f}_dKIWGn#{{82}nAp9+-}GQ8r8#m0&Q8^7BZ
zV)G}~BMxL@M`zA?2RJ`BD8isXf-;W;&md8_`m0Z&oCt-gEHbEcj3Ie5pW#_V4wZ>9
zyz&Cn`W2X!(+iJL?xQk}mp%Vu3BOsk0m3c<XQT&B3>fdd%ZV8VKARJkN5~YOU&A`L
zNTEuw6t7~=pi+AV6%<iCpU?388pEqsVeNYYytx%1CDX(rkUb*O$17Fg%{zjflp=6u
zk=XXX9ud1j`Feuo>!Hf!6z@GDz)Lk4Q~`v7_>IXoMV#|ckMISQ`hM7-;}aX-Gdoon
zL`rx2hUF=)($mavt@X3m?(>h&X_B3*q}DU}Nqy4$_Ps25NphfT-X<6!h-uS$egGIt
z^$QdX7V$_B^@sa`TynS5A$KO#rzD~SM4b6tFtUVbgFMHA*%&AlQK)FnB0>E~gnmB|
z8O$d>zIhc)_gQ}|Kh3?~n&`avUdGq<qPck|hTs7wQ4od^4MN732R&w&u}#M)sfxd%
z;m(A9$DHdSTr--vMrqw-`1g2|&$g`ecXkQWqJaGObwAO}1ei$F!M4*m7b%b-w;ruN
zV%pobR&l_PC0@ykSoTO9!8r4d>?6>a*HHFHQzvh=m*!`^?A3ZH;QrF2{s_yxuKSbh
z`)gV!UUiL6iFP!e_AhXUjeOs-kKzbp1^2?!Z9C5OCaO3u^7l(|tGdnCI5o2kfpd-z
zYzENB>ODbv0h%$VAhyAWdzylrFfo4&+Mj3b;StPz`-3RdIi;|sOy>FK92VAChf!nz
zBI~|o5_oXN1p*1M3Dl;e=h$U-?$Hpam=da=c`;{qjtsGh53lKIAlo32z#7${TCi|i
zR)R3(!jBm7c^D1a1;UN*ncWN@MO29C26`TbLBM4sIpaYT${+MK4+@{EYNjtHi>q2+
z*r?yHiFd7%+qv*g>O-JS@7DHicSOx~moB!~$EKdM;yVt#{v$5`dP|Z&HdpX|O)AU0
zasQ^GBCo$(%i@}p_4}8+C@-<Odp)4#sjT#69DM@~Qy;bwLa@0#K!8cY*DBMOI12M)
zW-cH>u(8OqcW8C!4uXBAM7F=9h<^r6-DEKY%1v6j7R2?a0D^`#8OZKnzAMG;9^6!}
zUB>3fNazzn{6MJKoCKub7&C5B9T!ICpm7mMA?3DB!KIjybnQ;IHJ1+||J}vi_$Bf3
zLf>hula~a|<F3cY5D*)Wft@w3WI?W>wE;Xf`3yJ=A&DlmgaB$#Xo0}FWg=Y*rnZjW
zvvz@L?p=~|8hhm}vpizEduQz?O4qHw-{LZjpR#1GCV2lfFRha@Ztlj`RtEGa@QVOZ
zsJjRdLP*bvGC&=?_R-yn&HKMkHd+LRsU_6u{iL{S&(r<!rTMowOV8ei2qJ>iBc%%f
zoijMST#Irnb{J$UlS}a}!Dj82QNcht%VYr2(_t4FsHP}g{S>G$Wb1Ov>h#*EXL&)R
z+a;~;hvFespgWU}hH8bS7(#a~)1N6;at=)w=*#qs=|fk-BMgA+frxYFeyD4A_}-p`
z`!_sQugdzq#`zhN!Rr)s-YvF7Jm-?PU{;*tO7rG*vZ~(!we=$;`6x=E$=h6D4x*^*
z@f;e+B@ScQ<c->ib4^*%Vh~2pMei8U<^p64WHVJxm%t|9#Hl1w5)vwv<59r5#hcFT
zhL*rrf07(ipi2Licpp3WVM_U#Msunv{d{BlR_6$t>*tvTSgtv_`6lO@Zfj})A#ZB{
zT@$b0eP=~A<_CoNgoscQUq*KOr)JD3k67UM_Z|LUNm=~YH9n>F`yb=?q=Z{z5?^(u
zr`LI<Z)n&)1TC*$yY5f0wBXk?OFH(NLnBI@coedz0jYfJvOe5_tYYgv8x+WId98$P
z=6%2WC9fHAtdi5Mw8FkSSqJ#)GR~{#qP(C<<^~lpKz12TTq}nht3UYc-C^g&+1z^L
z0L38dmV`PY=k%M@H~2InQYc#^{fIAnx6hKIjR`*Lao@ZCcilb+#xy;}-Sl<qofF2a
z5<+OoMJkJ;>WkO1tnoVJg)B>NKHr38M6%tnbp?m6897zad|PFTbGX{gQ+)dRQYyVX
z_oVS&(7BZs1N^&FH7U!Y)JaIw6RH~~;E37IKa}w~y;WXus~a&Wo}cy06d2Z1nJBOE
zCCQRYlGk4pzh81RjG2!6|F8ejME#|Vt5-C9WzuAIr=rZYS1Xk+SzDvs^QgA$sf4l8
z4=k@qjFbx8btJykh1br(lnR=8RfhONeU%~|BYq^*KP*k>nBUxCEDZY_O}dh{3Rzku
zsp>L4!RhlyB&a*c8dHh1hH*l~cF`9Y4gaw$awTAGCPuQP)&cxEsa3WCgzoK<weLIC
zYodJZHC6eK-b18gu&l5R5cdxh68+wz@4=i@9uTX4u9PD_)q0G*F@j2$Z*b{b3o1+X
zM9!_5%6Za(W96L?owM>QUs2tjN%rR)Wb)?4&sy6Xw9Vsgj`XbioGQ}g+NCscBAWcg
zPgRlKYLx~SY2%cYmg}VT8kdO$9S;C{O3&syt&VCk|MESpU%x!XRbrKe?r#LsDt$^b
zU9@~nEn7zqTE7Qao9>kv+NL1QU2no&49&e3RjaWduPAkK?atW)(NzDf*=jKNSb-MG
zTJBu^`&<WUal{F0q4yDJ@b0NvtjIl>Kmce!_EIj$GYTZA&8D_@_73(N00aWrjXV9O
zh^qgbMa(Ch1-eT7!wVMAMVb7$D^mPd{!4LA{<VENz#s{9tkLzDH*Ire@=_*MrNc`?
zL}YnLa(}F^dKSa0ZcmSj6c)hqyZVRp<f$|))2}U4oX!nJTf=)va=pbOX^VV-nzEW`
zV?f+|d~wd}_93Gvudi{gSbfV=+f$xLl$#B#w{uF~3(L)eAPy|``|l01d6B~v<p=LF
zWpawM(=F>>0byvk*1F*w+<=13EnXmSg9q}gIN5P_|JU(;|M=(H@7=d)Y!Gqx4h<b1
zr1`C3?I-$NcE|VV)I2B8@hz+M8;1I&8t>7?_#N1}VqcS7U-A0$2iV^$DfqLNQyh%{
zC`j5yD;Qd!0%aBNwPEw$iUMv1!1QSp1MQ2_O&t~dAKm`&`=b2cD#Qm8#Cx-De>tk{
z$fbLf&dJz4?>!ZDtrVu6OXyN0$X>OkDWhu~v3Q3#p!dCF^kX6JeJM8@32Vi26(l^D
z@k_(!OI$-WwJp!d8PRY5VY!deo9=Iq>$*&zv{eUV^8?t=&}3(%Kh8z-ma9Cktm4dT
z>%}7z=^WpEqegMPTl9O`*f{Isp^T_Xc_Tu7CYH}W7^YRExl}h;`MFuh#*oNCeWcg^
z1P0Tv#mKp6w%4lA6lSFc;krDs+Ify4d)s3yCOG%6*0pBwm*R3&?(p2y9)M)9e0dtz
zUoqIbRw2efxUww6Ia^KRFXuqb`aUrj-ZpJt)3?O(&36C(?d7RW=N#_8Rx}B8JFttB
zJ+BRGVhEltD*h5*(^_RIe@p)L{F3|<V^wnICLyt!q0Q?x`-cQodeLi)K1}oJRga@x
z<Fc|}tl;`J6eGx*_+q3-lv7nP?^2u<zddT%@3}we+PL7UIKM+KI^DE=7%*+8OWg})
zlM=(Vb`8S*w$25{=|z2UPCJ9=Z445&5tsIN$r(EE8jWdU#QN5A9{c-{&2pu4-54OO
zzNXjvIQ{VSwR4=kwp$!fW;>Rg!`ygV#4ss_f`|cjDROn5L7A^mGa}^fH3ri)9?o@W
zAfBg>xEpDa$J(A<47Hi5U3XhOz&f4h$~H)u^Ts+9jCic+_IvCb2b0B(t^o{?b5Rcl
zve}xy^K~uj?U5LiTc1*JZd%NH51m7WUfXTZ^<y+pv3u*!%8;#d4zKnIVDNdlzuh_Y
zAh%4w?R8k3sdUc2`BF3n)ixqz43LdJesrvYz9XKh`$~4W$D6g+Lkxr)9Coh4M%(wD
zqns5%1XK*SmSHrA>YRovi)S&&xVkDF1L8_Xgz1~-kAXRtMU(9i7zErd_F~}N+GOvX
z<x3{qIWP;Ic8+y+NCQIv&6bHdr{GqrEyi2e`t~O0L|i}8;~bvp+Y*N2U@ene++GiW
zEXmHgo8sKupMUpCyk>xf>30mHvbrK3gnp|$b}oX3P3g{YZZ3Lsj&N&4-#NgUp+D!C
z40=MHW1KzQ?Rr#qaIy-+(k*pFIA`Emce!(LFsrVO$GR{;HiGsXpAzq!RHrh%YSVkU
zWp%3kS<`uEkzXjB0VO2xxgQA;^xvWT3tVO*mEK1maPObZ!qpBpJ*j9#PgP~D!r0Lk
z1*~(TzE)Z6wFLwmP<Dce#_)T&A5kn%RYkq(y{ePe&migdoG4;YZHu?gNw>mQ3<@r6
zwf%S_v+0xOQAm|{^I5>8@{M8%?9?yzK6-%dKKmqCGxF|(c>GPwZz2X2I1oWX74i1I
zM{Yz6p-&aWa1=3wlF`BP-z>d8e$vULvyKb(G{!ILx0yG6hCbsm5X_I5paJhwXKUtR
z4mGEOFwz%3pI9E*Ad-=g>&!!iT|$sWNHbNJSx7qY8iuUI@<P=9R9a^u2F3x|u;gkB
z&Hf?<c0>>99<)!8UYmS^bxA8iOH2W;BKZWawe24Z&zI5UiHe2Kzv_ss+0%V`w|8d;
z6d>WQdT!CpdCiu<Rnh)&S#!;5V#OrbXIW7oK}9D7*2$r;3okGsaDHu&0DwS(>hKw4
z0q)TdET0PZPz?CwIpCQ~NRw}3JQO@2T*syAul?$__)J-p`ZOFBjGuMmN?PRAOm+0}
ztKKE9zM4O|kU$005s^F$xcU)%zC<9ynh}%24`eV4d<@N~-ghLvb6R%)WQCCm9tA`)
z<_k{c@^G{v>s0^{&{YZ+pE-X*hzz*&MHo^h6uA~22zr=SVRoNc!Q7I?0};-!dIQ~o
zT-F&fR$pH?LU{VbF-DbM6Q#hBRCG`T{Ozj)Bo+QV-R{o{-fMb3C$<wk`=1Azr{Y$<
z1A%~B0=Pfz*3<(k5>UUF`+}&i3ZztCy!So9Ck%yleT4HtqhnRi#Q-+XA(S!|jmsb+
zOu1Fs7b^Y<kjf^8B<zPPadv%;+ns9P%h<9iN&^|PK$0K|6fxNkKquAT1|;;JEIUAU
z$5doh9hc@EAG-tk&RYJp=VL9YMM7l-h#x2|2uZNKF=l4V(!x`u6jGW9m}|0)WXm<2
ziC94h`;u&JQEPXxvd+VIx1@urN&Qx@$Eb`1TnNQCs{du#3oF<mANsiaM}05ceD=xG
z|FK}q615`{x#yMTqx-RlTuYC#)1T_{g(}(}av|+&Qg#;vn<)d!vcv8Ot?QI-iRPT6
z569c?8v8_2zrPaP_Y`)Nv`m?I-&bhU2)92+n@s}Axr>JNmCwBJip;BH^BU3-dTQGu
zyE~+HDKjc>?JjDHkN276`u%DVEFW+x>r@t5rUb8}-!)F{H$d;M9GTZ<K(+^u54hg7
z$XX22ZFmaz^fR%07^F<~*i2s3UYfUXn@X^*TwHA`{YO}7q*D?$9iIodi{zw2y3EUx
zSl@E;{+5&lTHs{e@Oi*Jko2XM`OZz?FmxsdbZ*r0+a)PKVv_1(-9ke_Fk$N$`jkBD
z_0#S0kM5BROa{%U>YVu-5fy^MwDCY&et*5abhFZMu|Y3((XrJ>^mlrV^B1JG7k7#L
zxJqf=f3klLvS`6ElzZJTJLm9n27+Y8mn6`6t;JN6F^Fl?+K!WUVCb>2cR^vbWvBkZ
z*&7BVlNiyto;14AD9dNoh#eHoEaSt_hjSUfDAv}6ZKB7Rh=`;-RQP0IG0``_8AOi<
z4mN`<12YP*c0o7!o=A~XdD19UU&JY)KYX!9=Qp=H$4p2f2+`YISg56fiat&FI!)%A
z9thQ=oSz)+KLCuSo!|c<y+3N?ywAXP?&*L&1M{lkvE*?MrcW8?f&(>2-0ob}uL#Or
ze2>j9N*;7T<+V(nQF9)s5$s0}`>MV+Ya*ri{Fj?Wp>Ow|d%#s6mqK4{F3w5&l4f5C
zIN}IJUdL&!GuNlAIDN${=6y?(?~f@899++t&Y#QVn#HH~!pLw5yYr*DU^Do5D?qk5
zXqN2n&Bkpbf<a9aA7PXm?(HZR3<?Gn+mJ~g7%t;9(`NbmYpTTZs@IsdhfkE$c16dh
zGKt}C2W@&344A)#(C&>X;!2!<?8R92eNcNbZ1<`j@SJy3`u6X?{>LA^a{>33_W+k(
zKqh3N_XsU8)4AMNbzG;X|9?}k*7m;Hlvh{%19v!JA(t^BZ5UgwEn!e=xxnO{bnP*?
zkF#NDZAN*Kw~v`m@i|wD2?PymcWZmOQQ5Ct_iUH?+-X0EE%NNWJt7OH8nNQ=`=z*5
zU4rm&8dEbJirp5Q!vBsob^R6zbWTN^C;)@V3-PCON}8%M1{IgR3I@J)r;LH|A3NvG
z7JF4mS>L;}+FR~d-K(1B&GF7Ozr|LsK!iy~cpy1tzT`}V=8$`3=U%^z-YzA?Z-Q)8
z8{ZxG*aWpoloi%v9lIYVGC}I-g3{!h0!b(*VW1c&eChYQ6h5<Vi-wZ=gN-m<uVO=q
znck_oOiy3my{EWJ?B`y15O5YLS&>YL;rW<Pwk}b^!Ugc&H>EbIz7IG$n{L#zv-g^t
zMLKQ>8U_hnuUqTxEGOr*wTGV*$Nk+6;mR&}*P=?bh5mg}{!$d>In7mIj+9GnlhZjw
zv{Ot-wFbx+C%An0<5l@&bAII?$4+4M3`2~}OgaWuz?Jq3TIdqo<eOCV5(q|hOdm2S
z```0pmfJUXmrq4D6JM)OZ<oCCs@I~dU*r6&bG^!DXU6W!EDazUh1kd7^vauFxmnfS
z$yxKn-WQ5<oJtzWC=z5r+Iph3icb>4{ixqO*1nS6WdVo3OSpaprka&Lj^S+ltw_&t
zezF<-+q+?LKt2fT`@p8h*nes8{Zibl@4O%Ms6E3}j8@b|>NyYM^5iA1({D+O?tjvA
z4Ocv$R|{;)IYKx2CK8E=@Q_j-s+egoH}!-3QK|kucLAXJ1+U#9qrE^}*Jb*2tC6Z{
z1{fhKr#}l$6M{NtdRsy*p8lfncxm2jUTUQ{LEB7kh}C&a+HgI|+EI|a`4=n~(g|j9
zZQkP0`nDQy|JsqSg9=8#520&!qLj%g&X8JETcYLhxAf%`@2!7-bws!VaOXM7(<gj}
zFN9#ySID?j_G&eLAK&F$h~HHT>YLgR3<7q~ME{fK=i>X9^!JEXWQY+G;=mS<OtEvl
zUFWfLc%7Cs)0WLYJ~c~`fe@~GS`2gxaTEx+IS-2gZ9!)-tjeZlV8C3p&lqf83K5J5
zxO<$i5hi1BS&wm7#jVuiy7sXa*ZZvq34HEHDnnn|#4|&~`4wdCXU6c%niBWM*y(fA
zq2DQuMQL*Pp2>B1F8ews-^BHk50R1!#{7`>?<{|&Wpd_1sqPn@D^PwscDLm!FTT}<
zS1A*HGOrEnUajh|>HE;0g7+=0Qr!avgU^VF5VgrIN<x7AoASKLo0sOVNtq%&6SZB}
z4bjrf=8n1pXw~hh{S538aG8b}aY30h8*^Hi?FE~pQt&?ck`KXo=WqJOH9l!*#jQr{
zfwtheb46b=ju@0&WVCa--I3L0oLA39d9jWK_YSAm5IWCC?%?b-V*lBw^ZCb_>)p{V
z6A}ZTDK$~1%~Tvp1y>>)2p%y(!yleIwVUaR+4PA7wg<2Go;w;Kay<m)lkf@6Mfucx
z`||;40?Sq12SAE^IHnQl$4FdbNW)b`N^|1uz8{l_;0cI016E-Ov(KUS!f<|uqY&Pv
z2qMfc7#zVgxczR*M8nAu5h6yz1h{fUIR!Y6uYM1ZzGbn>eZE!R+a>dwe|~$dFK|l(
zhvBw!qWK&ywj}}7Vqal-<>`og1Zs%^7kGw=Sl*sGI%9LrH6jIEy9W`L5hW4Innr;L
z36nlyLA01CnL#4lCy^9`KmchWF5vweKfuZ)d0(uZ!yy7Mjs!aygOsr;qX<>OvMpR6
z6k~Vqn)c(%N01C|UW5dAv53UVK`34hBE%VpLbv>{w>V3m)8y>E>P|MV(wqN~`mTJ2
zmnU(CmzfOWB@j%K;$h-QIW7r8yc#7XP)3}?1uH|YIj0bjh;9x~^L@By6Q2V{mFB13
zk0_GDy#)>{0U($HtlS$eVjGx9_XG+hoOPT$asiPGu-JulvC{TFGVz7_qb2bf@gt%B
z;kVbf84JS!fso$Xw$oe;u~K0Z8l>SXoO4c+AiztQz)rLx^-lO9Rz)y?d*~Vj+!&C2
zikFrMsP{LY!Q~~(0UQRtq2+eY!C}Xub2vVOi*fTJKPPoksy`~N>h$EDip!HeBv6z{
zOK5$Ll=}`MI0Q6swTkgeFPua65zo~~s3<CgyW26S5x6IiK+1jx77~M9!;vlwOv6`Q
z_gu5xP<lX7N8;5j2VF4EnYJ}5;2faxBzTHP;F769yO(>WS&Vf%4d9$(8_qMjheP19
zI<!NTP_NAd>Xnd~r;-Qweu~#^8o;F?gAp?fNCU<>7wTbSkaIZGhrz$z(()@*eQVG}
z=^T#A+^`DqP<cN?%KL|_K}@XC?)yOo4R6i~<cE0Hnj?k!!&YDv3UN40!>JAwOh}fI
zSX4xhn7*}Gnso3?0*LfTyggupjS23VhIjjY_)LU>No7Pxsy2j!L88GLK<5<l1Ed%1
z!6qOKb`5vjVPH~05mZ)2Ec;lGXh=q?Q*YNDFyv~uxBvr_FOfJoSPh6mAf$@lpr{T)
zAcB+{4PVvW!y#BTEUdoY5OAk;h{P~Iuzd1len6N{hzOPYm(k+=5yP4z<q->fveeD)
zoIb;?q|V`(HThx)Itc)KS0tSKAC_*MOBexMa?g+oNd(LP6Tl|FLCB8*X?bCpdkzL*
z)orNq7KbWt4eB-+l0E3j!hl4uD*qg=t8dtqfq`kzX$S&ou<PErAQ7;_zj;+;|D=t;
z)%}N!2hQ0=B;txK^HlqYl0Q-}4FTNuPvGYKhZ|%;FojSF+F;v{dnF@Cq1n(VI)^hD
zly#3L0NE}y{wBf$qJA?`nW7Z_;1p%B@ik^wJfE}V?WuTs{H#46VO~7vLBLr=BVRHh
z0^SdLh8HuZLC@^PO!Zp{3zvePt@E9M3|Sya5Cy*A><66hl<IH4B?8+Yk?mo){TW7W
zX(Sj?K!l<Z)&J5%)IW@?w1+ATe5g?Oj~<A+&z2BviO`{7>bKf07_gOnNRLuJwFoH=
z=+1?!uOQxi0=(HnK?00EB)r$Be@x)62sKni%whuf2vJ7rd-DOespIXPw%*M9ce&gV
zt2fv8vDzoG!d9qWGpNok$h~oRx(>MP2XIRZ#S88&-gXXFHuq>OO7aKCLGIB|sF0pQ
zh4emNSpjgY)pnZf?{lby+8zP<dp>dvfCehd!0Y+*sd?gagec=B@_^kN)H0IZpK<!>
z*L$@&Xr-X2KPQl!GGB5gLUS_Fh)XW`;MtHyzWzBkFc}eRCt#Cr5;6>eP<@S(6T)f#
zd*lXF=H5-!r;^crcVC)kX`akH$G5-Wor=6p^IKe}MeaQn<vFo9IY5XExb#IBQYO?7
zzVwp#fVzsl`)q>#1K0Poe)XQxbL#0q?lL`_&jRfJWNt)HBiREYDo8Vec{Fjr+jb9(
z`-gVR3}Sag$>mzV|Dh4E>VK4ArTHJzs<zdD-COCdMU`p|P0oKzpOZShm>ZJa`>_WW
zq`1`$En6+k;&&_aygMB`Q&J~yb-Px>d%9kLg6*fW#dc0kMcGmm2VBS7fy+Qzhk7pK
z?|-h}v*i4*J*`Fygx6Hr1fe5+1~Z6jih{xCd1=%>=70W-hSkD^W3a!o<Jb6nPF1dS
zPOJDSQ;>Ux9mg)&pKIAY^)(Yt=ak!U*T~9)6Z2HFeE#P@Szz2<9&Pj)gX^1#!_UBX
z3}dtrS7PwnYJSm?{RXn!*Q7ipc^$tb-X$(yQfr3tD5UCpd=@aNP>O}jf3BeU_~=p4
z>^?I@xJAC*!JX5xe*dH9>F<lO<?hdd&Lwvz-^7`eBqF+s6ok4k{=@6lr#Sx>S2OkM
z_7}V-%S!(4)yWxLu1nF+X_l1=%9ociKBr14jiCjBvb8h{Bd#)G8Cuv`NohnPIz$$Q
zK`5jdG81MV0ne-IviPdJXO>>QGO3bUg;6STGd355D$R&O7ByahkZ?g6dzOFI8FZgb
zMebBwn&OA0vDiOS`dd;KUX}hW@fw0^hNFcailuc@<{iFk5}WJD0Srzr+Km=Zf6<gn
zbFX7KPAvS_TYT1KqSG(8@>}w2fhK{~YkV%gd&Tp!)?f4IBjPI;%6%@Sa!X+#7psAf
zN8WY83%T!ybgH|`uxR~g?F&wrspH^3G{T2fLml$dw)<*#rmk5NBYU^MNm;eY&gHJt
zil#jA6jzCT2+VjWBdTmcM5xaMVT(4!_@Gu81awgbZMN_1Eq+5}=H1%+Bb%`&&YxF1
zQ7hxTdM?UK<(+S(E|OVAc}Kf2+h(ubIlC32V8j9Ue8c<5H(EPb7gso}Lx$TNq&+BR
zX}rftH`66v{Hz?Fe#|OvaIyWmGug5~2m2B0>n#T{`zcYzQL(#%s~j6kqw}c7%=$R@
zG%Z2@MY(F_2LF)P#h;Vx8OLESIzkk?IG@X5D9d7K2ybkhYwu#b4@J7II2I$eF)FNr
zWXg-R1`vC*Xs977HOrMj5I;9pHg^tfv0jO3YrN`f@;y158|&SlP&W}mJ);Ja6BZD`
z6hBzV`Z>m@UQq>88r|2z<eQ2%=U!3cTU}JAvQXyOlzD;>sxlZBYC)mm2ds9~mZt}{
zRA}SOQ)${)@B3?#d(Xw`R#}LbO4ocpl0ifm=OO(852_&v`_eT>H4}jXAf3@0`QG#^
z@~nu@%ISMbEX#MCX`V%35W_T!=v>boHRi>ulKiaF?n|L0PW|<pjYHVKpRj?LrB$8e
z3S^PDN`eEhA)BsOoD;?4ys(&MJmTciQ<AmD1T4PX;wwhlJxf2=g_Lcr#UNfoHkIN0
z@5cNk=iisH#eAM~d>BMrGcOnjzb5Z0=gDm=D?ZmD6(NDoRWc@mCGV!Q9i=LwAEZA%
z>W${NpREJi%y0I_RMl~Qj<X_9y!PcyCD|`tt<vjrTI=3^bF87{VdMu)Wr{utR<Vw<
z#rf3+?Ps6EYQ*r}0ShIrf%USy-E-OrEJs=P<eQijMCo!EFvT0equ-joPMd(M%6rlN
zJyt(<GsmDj*Gx8Rv$6AlD-M>A^am_XFkgIhz^(#`lfc-ln?4o{6lEZ?VC&6&2ha#=
zKc~ehn<K8Ad&M=$Pg$YTi@)9qi!%HE;MzWcX73GJGz_^65^nQi8$OoBckiVvZr5&i
zQTuuf_T>4G+Y`%ZI*v8mdrr%$_Oe8GPy<24I*;)!tx_fVzqFC?zo+MOlK*#H+KhG`
zU|pZ8BD*Pre_zSsrFo^-iKU+zX~eK4&R>QB*M*J=r!xC7hXKe2w?y<+uh;XMEduwx
zMI7A)JOXWE^DvMCu7@?Y#qK2!>LSg<wgHEh1_l@d=ysfkp)J<uP7mk^yC#`p>C3N0
zk^P!py|}895-HmI{!|Whq^r^bAp|^b*=jDZX;~}ZV36>!@6mgTPhYhK%+KCyT6=Y(
z49uyFD~n|fc(+6M=kZz~ioxT~o1N3@n#J#4{eFd7#<Zfv0ErJ$ZMvn@Nx3pyH?ieu
zF;oKV?iJoi(%IU+dqUw|CEZAIoLevhn}I<{yGR5B^Ur%H>R{K2!LIc{2m|A0B8UNV
zkPW(*eBZpUYcI*4jwR_)5Zz}N5gO9|4;^fL&1_p&6skX@zh3WL^kksdE?B15|GZ_{
z@5|!yYw}kAXK}Wb^8HsTHm%&9Xj}JO@*v<WqLD9|5CQ)Ib3l}^&>Wr#33tc1#b?+3
zd;k9HfBf;^llc6vS#p_gH`E(N{*de61Jtnf0A<k&=>!x+@763b93G-I-_0V!kuIdC
zqgOp>(F`NCrM1^GdG;D6qJ=^a`a#u-=1`##46aGfMCyQ8i&qVqgXV}}lW(HF^f{4I
zePJX*!Kqc`KQ*Q5dk7VL6!iRy3LY0Co@YJUmL*l?WyPtxX?c73TbgAt@k0jG(Ql5_
zwf8bd>M#PBd=c>p4Ma$(40)*j<;T;dOs-jcN`84wGu!<Id$a6RT(p9Cc~N`kPFuP(
z0Y|QkK)P1bc_#l9q=S&edHT8Ls`es(R58eM>U>S|<`PvCq*Sj-QhTT3hF2xr#)%Re
z_(Tdy0~v*p&m<*;{BUCYN%scKF!NL<aorVq-|AbOdCI4~*lWuHyFv|+I**R4TiHAv
zb)Bx2&EUCHa4vZ~w?9LFR}@OlnIwV+KmIl5axKcHZ2ABDk3V9Np(pCi!2RjYCf`$*
z?7mPA4C;f9+Hn90`w}n=vMqbp{FY^RUSA<w<WE_w5}vrO%k)XNrGI}->!iA>PzH$o
zYh-i|&V+)0Zw6Uw>96{!Ygskg2;i6a3U>VcRAhg?#?XjBEXO<p{~ksC5Bc?0FN=Dr
zf4N(^6K8dM0KvG);DDRNYw(O(qj$nM!%yK;pGPzZn3RI^9f+Z~*Wr+0C}_(v_H?$q
z^>)B8`PqEQ^#7Z(bEAOYxmWp1^)Jb{^pyN}`j%vW(&cV6`O(X!%3GFr&$s*pc`JJ%
z?{v=F)-~UskA8i>A_entetIp&Ce}Hsv`X`H^5)r0z3#pk^nVnl;`@xX*P~zxW?I$F
zVTt1E-LBqKR-C@-f5)NfQ(eTKLXqLsI%c6cCzv5)|K5V^HCN!AXHBxJtl2*)tGgVa
zwTD%-)r-~d!?7_-xJ*QBCvej*ihLo6(Cah(APT}CPlYCn(;3i876+TZ{UdYR3VJYH
zj<#Z#<ebKhDLW_1^(24N|9HEeW4wXxHjimGRG;6~XX&YHWkbWM$lA^0wD{VvJO(Vb
zn+kw)pZ1j9%HKA&us=pUDLGfJaZbE*ana8dm6FG#Oyf)+A-qqD;h@wm@4uQe!OK4H
zTl<dj+WsxBy!>`~!dnxw3G?r%`ZTaHX|8AHF>TCjApk?5<}?_Ga7%^{gLa=V$@|C1
z##(_v!;@|!ER(#6zL0X=?U>LxL?iEu!RF#tC*`kzI=uEc;GDrTRCA7LwtVccgkl=W
zJ11O~)c;+km$Xj5CI2VRZb;Zn5=-YGS3?yHYqG*)41i1S76aYO$+KSgzx&;*5h&+(
zxK3HB4BY>u=lb=Z^unoo9q<p;pAyRxn7f~~vcPJ@?A-zD=Eg7jUfq{-ak7=fy{~aC
zfCIV7MQ9Xq^$q%Uj3@)q|DGRnldGFNI?t4EzH1R9zJE>1lWv-AUkYFrdu+fnn(NyC
zRF}nmg+swWkmqBadCR*h{hReWwKiUna)gZWK)KPt0;5#MibQm%AfXDS2e-I4Fm5n)
zcX%p-0GnlO>C_#${u!XT9#b8#&^4HO61kp49gxU1nCTIQ&IM`8y*5aIYL{IK`c%Am
z-^=)_pn9)yer}dUgQY61?3GESv(U!9qajp(M2qVlbb#UOd{mL8`o3ybbSoU=?D}fn
zG;{zN<2MhQjt@S+A=S^-@9*r(gl^8US>N+K;H9g}ZM>&4i9gW-DTGi~S%Kp!787!@
zx;ia8%mWNLrM^EXZDmQ*kf@B_srKqJ&a3C5yjbiIRT(Jvxs)ocQwjVU#8L9T1kv|H
zYHd+4_&v@D8&ulyVb#>t9|5byQ<b@-Z}rV$lQ>g9E{TYYq)Gy#V0o*p8TkkgB^7<8
zxf89UVVZk!UgYnW;#Rf2&f2xS*z{%ZuIFRHe7e=O#n|fZ5@~Z${CG9KB>62%E88Gp
zcdmY_AmHLgTx+p!b<qV~D*X4d<hgGCp&aHb7?yl36L3!8v3%-gmFG0E*nD-Qi+O{4
zky=iooU_&_S$2+cfxFIe6-_^=iVf43{N7Ia4QQ7|Z$0R1ndm2P9e!7Btb?Px+y2ja
zK(ms-JC{NO^Nf)O#Bb0wkWq4~;_TiDADsFo;5o>Z1P=q?N0!&Lu6V_>_YpKcVnxeJ
zw%fqA1FHkty0|ufe=1axb%7=Qv?k@;s&Cg%T)W0k2`&cXKmWw-LbFz0v`irHZ}ykH
zr*k{itI|V-=LWSsqrhnI0^iCj$4{UxknfhO`3^)hY?3=V*C6}SGe)KIx0M8)lO5~E
zpN;lA2m5f7cy&Ot1QR3N_>H-Tb2-?0fr9V>^IaE^!aDO*ZzQO@zt=AWpBO}(w?=Tv
zQ6+JCdbNAf*?&gG2qngNPkg=V#b{-cpOaE28h?qu#d?fZ+jqG66!jHA<2?g37zDbW
zpY>V{yZMj(VU0|(aY>p<<=_L!Df1;~A~d%r^T2!^fXs;hhrIVL%HvRPo~alDXF@<I
zq??w`IlGsX#VBgoU1L;O<b3vS0gahQ-5-+eiP8fgSsXMv77Yr4EbbT|Hc-l>h-Bag
zf(a4&{pxMF5lqhxltvL1169`VMeQrc%t-0u7r`bG=YYAM*SyAgl2u;)9d5V!95Uxw
zTn9>T7{Uex!oyF`toae;p;T6i`#exq%Q768=8sC3sN`nYjEJ`rz{xiepAsqqJ)E!p
zUl8=UBtBzJ87Eu>1NkYdq@1y&&8qMFfm2;N{nQF(q5`{+>x!NdF});tsc<^;^f31W
za4lrhmE@~9x6-xUA=dGe-qhn&r!u|PmPNDOr%e~pxt<hW1m=1^x6zqjT9K>%kpG(2
z8Ppa$1uL!J`$~bi7`dY$5anvkN-rtPX7Q&@N9<A5`jm;={{eVe)|?aWsVu%eTtwx4
ztD1#mO?!%76p4fMenQ;)UZ!>86?V4=cYi(0i|3;7RM4cYa+NC5DLTe4Wqd_?klrxP
z7^ZJ(p`k8ZJb=Ev)|X5lZ%E3#SwyRWr+5Ulug)CM4X2l-b!|Io-VB?a^(k>kXKaer
zxqkm<o!Q?RJ{P%dl#gL@TzeSwh;`c<I#-WzI*g{iBi(S0$0(@5kiMt*?7b=ZtFpK<
zkGOVM+Rbd!IghO#k{qPH7~-{@`(ofT&f_rPZX|OM(fx+Az#!y;*>gz1$rtg!519z0
z2v|f((Epy`GgbOfQW^GN>Y65+YNkpb=jxXfIlSuIi+u}KKu91ZlaVHoSUUF8qs0g8
zx!s|GB$E4sMTYC>Ojx)##0JtOzIvy)GAG;t{or@fy`;}=D|maN8_sPQ0CnzipW|=o
zNm<`dwxb<1x~ZkGJ395T@gEWBR9i4cC=93wEQ!vc{f2(c-TS>i*C2c>tSrvY)hV_)
zW`ArC?hHVeJ+6~)qLe5xZ+g^x!NR_;-|BUkU1d%}6-D*yavw7_bCJ}?FY4j{xU`+I
z3<PH^;*lUqt^7fw##R%-9C*%rE*O~uKgG8d<?RhkZ?AgJitnxaw_h^4e?|6z=>sd6
zXFaF!rN}KBy7wPQ`<iqdz2(g#TIKyMDdAcLH-!)5O<+v|owNF37`q7m8lQAc?<Yct
zA&d_$_a;hIG@4X(0k;i*Q^9e#zD`c(IMZ`i1Xr1GnVPRNa^O}lL~oH`81On&Q1d4<
zm|RYwOrv)daI3E%>epFB{UERyS6H}26oqW`aH6dK+#UGAJeBM2Q0w8YV-dOT>P4IC
z0vvmDKh*^|_BJyc;fDbw%63SfOX6D$Va$rEGDF;#gIAaQTb!kHmkX_LksP2_<{S3+
z2Sd$ouO4e~KzL<t0*@6O=f1NqIL^WJ+2kAywY;%>0C_A<j~)ufIj^kmpze-{SRU~_
zV68TR>)5`eRntzC=tXNW(#aL8m~j7|$)r*^UKw03f=|r%IPQP*h(tg<yUX^uMig&~
z)S&765u9M--5~G@+&M;{SSIuPd%602Z!7Qi4}+1cU5MI2tm-m;zwbyb@)~RFxy=>p
zBV^5Dq0|9rEH(`8FI0;{?;P5IP#7xsms|eTJI6KLwbOx!V?bJqV!#k)=y4VXy#_wp
zdDrzIsBzA&yDaIMIdpjkg*TI`I%n%3kij6+AXmkJbQi4nd@gls3aEe$N)9HF4p?%(
zK{)3Mu;wE{xC(U;WKfWBkA^@MYlwMPctE;uoKB<2xo!Ky0SvW#=sJQ*P`SR%HGyN<
z<s8j=#OxfN{pkf4)dv7F!4)2U)AFX>=g>a8tZ64;lW&rQ^C*b)P*<S0=UU9i&%JM}
zKP@Dr->LOhWiwq`>eKqmEl*E_^$@PR12igSn@%{*6H`PGO$+nvgMl`r7=lzyi3K8A
zHQ=buorSiYG5e2-J&@G}D!Mn7+k7N7aT{yl1P~wUd3r}06KY_UNfy`XH@#;J?~Lz~
z=s6$YozqqnP&L-5<j3Nv=UaZVUpnPVJAtsJmupeh-Z{B~YUn&b=aOgO8i0s+uNCOe
z+B@KB?sY!`6h#+2hI4Q$hQ>KIQx3b7$LR=V5QI|2;*#izCKhpv5z5(#roh*w?!iP;
zo|OOo>wo-lcBaYvCH{aGdWw@<Sy##NW=#LymaKv`3j)6Q<1NfbcxIVSnUYWl^~dla
z3?h{!P^&k?sV=MUAyo8rxxD3RzGaU=tj<3?#1a@lZE|mqr{5GYm5lpbt5PH*`Qx?e
zsW`uT*Rr_AFR_kEXB6wcfN56eEc!lnuP@lUjRPPtuf2i*2h36fiTY9W{YELJ`s0FC
zNTaoeOOSj&q$66LlT#L#ZTf~JSaQro08GI=wNT`XW5W}G9JPq&Tu=ywb+&_a2SBoI
z3p<2;sK#{S5&<v~OH4<&LyH;qW3>(f4XAOVsK9J1V23af)kK-+f=3tvq(|IEuAvB3
z0O(yfs!>=75>VjTZgDuojDk}P)uc{z005KuMlL6o3q`0VF%1B*ELVm($sthcY73Pj
zM_in~<1;Ds24wx}AVN0yBK8Rq5J{qd4{zd~zP^;jEkApwA}h+-QnqbcdIab2));-V
zu7H&<AA!a^Up_{VKy4FZ;pI1EI7h(y4MDrZR~!_0mVp4sKsUdGLwN(xgb+|Wf7aT}
zF=&1kGmiqywp?_uOrekouv=han^1s#t_I^I3IxDpUV}L%cmWkE+ZxQlDGmymenV5t
z!6_;Vq|X(H9NJM7!eOnv`c${hF-8K<a9OUEImYn-LPE6+pX&ZNn2P{pGGBb<B!WR<
znr$oSUYI7|#7P**FqD22GC`vLh4&w`f3Np0(%iiNjbn~~e`R&R2pBNLM64phCh4~O
z9RIHUEv!#LEGuFa&H-a^tXlp*ULpTqmQNv8U$Gx+l`q628E(NWLiL8Q-6x1ub<5Kd
ze}8W@mQ8Vg-=(sNO#s03k1mDZ><2-BL00$8A7&0V=KyE`yWemdict!~KSkFI_{%$N
zV+Z&vH{w*pKVI34YFHp5WO4E4@3fN<xBnY)Is>ZHW%5mesNWnBF7y&TCc>S*hY&rJ
zM<}Nvi~>LG|2*5fZ>QhmM^ychVUN(~;#9w1)t@)_CTy)lLVc?wJ|li4)Ia?8mu$wu
za7nK>g>-*3)~~SpL$a=j?+?i)Q#%w53W01QokNA%5t`{Yg%OqN|04A#5ynIL!+&h;
zYi4X<mR5Ch$Qf%s_Y#+Xy(NiPoysD!nAqPP*o0mHi1M%cSU`IPu6j)pkVW@~5S<fn
zN!DD_Zu(8?8+;lODWXtsGvJGn->2zN7hjV+{aZ4(Rv>w+lQP$*22W*rt-X&U5Z}wR
zPQKuslf}Dm+fwdJb13D@DJv@5wL6EMQLWQjpOftFs9LP=`@7f`zeO*&mEdcF=bVOs
zCoMMF>YQln))<YRRvSPa)9wor)J=Pg!rz}!H=F~7IUX_jCY|;AOb`+VAqzsE{_vkY
z%`5$b&u*}~#I^dWb9qyl0tSKp*9JD{qV$>T<VS;oxkbX7?}|dnIg>=t;K!%CMSPyk
zqH1NF`UWY!UIA+_RUMbLr+)}9&AnUR{F7ZtQTQZ`0-?{)`Gf`0Z?9&JCcf4&ZdLVm
zhquLO7-is61b#q>AW}*`cz*doqj|-fSG~sP*}FSWMX40UE8}x|tGuVwQWf^E6|Vqv
zUdMiltMt^-*4!B>kyn3KAUS2e<SP$*Q(V2bz7Je9^0hvRZCpkS-3i?En}iB)LZ8Wq
zb4f_l_W?iV+3}K`(|AVYzop6d=8A9g8@#{XlG5Uev@!^R`li6=N~lDzbkS^Pm1*yz
z9(~%+da&2w8TqH(F<$=qxQ%-%@~ST5G_NbqroDT2Em#C;J1=$w((mcHe)Zy~s>p6C
zN3wombw|yg2dTwSo;#4XbKow7)1pDb1w7l133tr?DUl+ud{cK2K(5Fo0=!Kl2_up#
z_6G*zrgOw)xkcNt<4_0z-e%wnE|M0Va_&G{j5<MpgyH#Ed2Blo9b?30HXb3H^1wN1
zAK8l1tKRcEezW$DK952w0^+lPNg70Asai0D^zqRHY4_QXrhloraz^rYO0KnyQ9l5m
z0VQ!kTAcJdg45UZEy+ARfKng<YpAEE5Pl9dc`nNDae2Oj1tR2My)^$8XXytv>+T^J
z7@;)zub%o-dfo*I+me;BJ(6|=6|3}e%@Qw9Ub-r|O_$RV08ho`+N{LHgxArp181>>
z`gm}*9al%%n9gD+aeXW8BW_2Uf{1cOU0^USFda;@RUFZq^JuX`20V(Gw?yHzXytO}
z1HqWA{*(D=8-}}EVu(P+aij>w<jsr#hS@8G1i`qZ*NDDw>an3JCR1k(25%TXT3qLL
zT#9fHZ=r;PrWqY)5rdkA7!k2fvT9~vP;L_xL2bqs5m7W3V@CG`T=LFfT%L_-QG>>r
z*A^I2Tqz?X&~Pz;fFa;Zsi=n*JIo~XFa#SLXhf#2JY2wFoHc>KNz~LIBWTLf8xR`x
z=8MMeDQFNcz>somdGH81$Vb7#nby(a)ssw~fDq`n{bm6}(A6hh7?hLv8p^d8lsVml
zoJKl`(b#OH1D2?a=?KQ=iSb4NHBn$hE3??10fTTQtbxI}*hc~)hpYAljfy?L4E3b4
zn%ldFXV6dp!|6#?2?p6h7>fvX&A+%8$2oPzqvC2>iiB~!TNZ)cD<L8XA-9W)?&)YS
zfB{3zmE_7jA=eXV7#gk`NdzhmL))J&Y=l9%@^BB$W(066ZD26`-FmWz0lFRGI%4_c
zn?j#(y}eIL&I2~sgwHm<XLiFB5m68gZe^sE^0DtT>$^@_dit82z2>4pT6y2nDpjPh
zWM?RO82JGU1L>1MBV1gOH9D>|Kc3ru*82fAVQ#T<Cxp{)q5<WBBoPUGq6J9q@=b*O
zE+U+8E}0StK?VyIH)JyiqCiMS`(MMUj2I7jUuNq1IwLT3Qq^;}r>f+1E7N*G#;#9A
zT%Ol{&3jIjS&mPqLAOKwRxh)aE-55e@-G_FfBewBj~+jC_t{X+*5GU_!||9_CI5%P
z8HpeCpZXwO9)C+;bZcHdC$YDNlGOLTm*OcteKoZv#1|psl5+JAzKG=Vvc-r+Ebx1{
zS?E*cQU)r{n6edu_PtjRnqCB3sZXse^8N@fNgbEUv6c#xSKXeTOZB<U(%StY{w4kv
zx9Mf$H5!Dr`#U8gAtxe~(w9PzMbA9l{WuGf>#eoJ8#U=ADL)9=t{TPS^c@^iLEZ@8
z)_#%QsaIvi_f-nImO+KAD7nuk(&rl3eJx9zpI(a+Qt*04@DsXwtYV-!kfBnb3E#*v
zkBJAt-D^?Riv)x~IHDq^6J8fYL^|3j%K=VKOJb)Z#t&bIT4zZ8?cqaoZk^vn^BaS(
z9#UI}1_e{}R8%@3B%%PWa@w^Ru7rNBp{>RRuEC9>dPoHxxm!ft7?Ba$NJCmc=$w2A
zZa!>=pkmJoVg~p93>e%LLaNDpWDfzYCwnELZY&nou+RZp7vRd@2Kii@mPT#S?A>N5
z9D=j6q=P`#_hrCZJ4ip^ib4x{2M8>%IJ83rENpA>9RxswS7->F>sku|(dab+0_jGP
z16r+JgIjyEgkbJU-r<^dCUpbX7^j6((Eg$I{sY%!+ztj^BV2yo0zwAtMAn~?T+?u+
z=L(~3ZM}%^ntVUe^9P#bZM|K(#)n+aUG3U+O*oUtz%|Czhb`COW^y?5QKC>VO4R>C
z_0|5+Akz(W0rf>df&n@z)K40QOX%#{bdSY0p`3|BI|L#k**@d_cL(-So(Ck@Z>WB|
zBOC;{-eaV#c5<JwfH2MllOb6ilbk^7ebgJ1Y(JZ$o1IVCAJ{z2T%%efmqTWbzbF);
z&pBa)N-5RfdtW0y;jSrHo?i|Qx~A1>X6WmKHdxA+6{luQ%`1~@7M~LDR2EfrE-rDJ
z;~3cZl%6doy?4jd1he;{$n&jC^B2#$-f$G@+G7Df0W#N;W~L7i^qX1~*ThR3oq&S0
zt);FJ&JYbkyhb+H4VlJYM2IiLFo=ZUdS}HC|DlzD%<T$Lvh!Ld&tM#y!opyZPX!O8
z2$>{AvM}Uq7c-sBaH?5Ua4R#fO7hx^D`m!?lQJn?ljwh0Aap2OPB<B#(>_lgg~N7X
z()}$5f<XUk8{OZH4qk3qonGUzp5fhn1yXv6UlQ*e*Rc)z2&a+C(;^x~8j4uA^HLgN
zkAl9_o#LzNI6uc(kvr$*DoitMFcgH))ipA%F8Wbq42A6db+srlAY<>NQBgvU*U$LB
z<3jN(5QIblp%D%H>|&oF0bv2*f{fQ*&M0b`T#9dr_x)A7rOp;Z)NLNnzoqA-@KiST
zt|ct9O=I_lw@yLVCAnqd!6B=X1fyg)#;AeCPukfdQg8_!5CIpN?1qAqFOni)Dqy0d
z`^sIuhyG4QV<Hez|4fp}sP`>${afaijxiPnei)JIw?xW|M1H_k<QEP0^Zk}@=`}EE
zVVhgTcPajsX4#yRdAhyK{Riq}%4OtnLvQSJ5)A&w7Z|1FC1Q%o{U7e}(Z>&W|E%}J
zX-H8dExVpVDHs=_;40wq0}(EIZ}nSRSH0f#r1+wM4Pi;9f+Ra!R0?0k2Ru?@N2%Vs
zxX_tk21`X13Y8qfBGgykV7|2E2vUuO3IP)#j56U_a_|^(Mch*0Wf&;6i9%ofe;G>t
z8wE@FQbvQdu?iIrc<6iPkDG^(DpEhUxnLcke}RmMwOAbij8dOO#-utzq6i~C^}nQ_
zs3sjHT-<yu_#r%GL?Bu$#m6W>vki^cL8Mkh37A}|$dr2KZ%ao&60#rl0RZX(2FpeK
zhX|BVR$5r7-ywcb_;@~$GoM9>3{;6I6!%o7$}Qi&4<Qtbq`6f%#`W<?F~ru-91>pn
z!p0~Z=aUglXd8=S5sNU3`*z2upGqQxXW9672(n4q1z<!)z-{j`9b(&k5=gXa%s7F7
z5v(RO22AHkK!vGwphB4vp>&s1Nh1|lFB2+|(%<Z{R)i8X;%ikafbs(8!s0&PA;Q$w
z&=BqC(AVI=@@WuRWTtMohyZGm1Hu@pk-LGBt&w{M2pERh4Gf`1Su=vPtN%8{6Ll6w
z#PVwGF<IBJY>dFbQGo#h(kKOlVc#g!+s1WJyk}9MJtjLHsviQRY0($~6_q{<A;VA_
zF@hK?jO$hiTpYc9qd37~EgJ>Z=q(oo*0@^-M&QR~4}j=+_#%kH!NEHh0F{Q3F#w=x
zqZNYjoD>#dG;h=$fFkGPZVCt{&NmPtKpS<30_fqm2@^)($M2Ldz&KO?v5m~{zHD)>
z4HJf3lgB{_Jsfp5p_tRr;{*&7C#fL<6GvGg1f*d%ElkhHq#Fg{A#Q9(jimhuV@jit
z*jk4m2-TmYqBJFDRD{Grx}-u&B09w7M*)|U+S(A;1{05f#A#@*g2w|w;heJdg4zTP
zR4@{7A)2{x^)Cw(R7`myCD^<V>haM7RQK7)GjqXuN#XiT*CB`$iK)fh#sP?gkfHe_
z*C8}w0hSoGIWrcf5!;NyyTf^hf~pPfuo$Rv28pG26Dq;5PrvIynel+zgeiw8p8C{>
zq7kFK-xvpgXd0scfZ~i=tSLN%OzO{<wxxsPV<!OKjhrw5qM`o<05pl605DA)9Rj9d
zH~@fXYAsO=0TB`LZQJ0E;GtlF?Mv<P!3u(CjXVs1)0315z<f&c4lHjGzQquY14JmS
z8wGX<YB#c*2)tua1jxHl#)$%JRL?|#MVXJ7FHAyD7+@p!2VfdTeg*&$4>?wOj0i46
zi=MaRJs$$sgl=j<qEVN|09x~r&Y{2>xnu+uj^Y*oIUf}_QFu2Mb^!K`@=p|6jpB0{
zSOdQYAnIek2LNeQEJI=4C=Lcty^%XcVBOHW03aI6H;gn5tBDBGG%!slbQ)Fe0O&OJ
z!T@4EsvQ83X=I#G<Y{EZ0a!PB_=F+U&_DqYYE-rZknvGl1^}W_<^q6dWWWLBXv8%b
zg<~`__jJ0mT{rv&K_CJtN&n2l@S4%I?RWl~5%UQd-6#+t_pR529fFMcoS6H&gCGTw
zd46yRB;|t<nHNMX1Qn}h*vq`cc?c-t6AH;k^`Bb?F2}%9@swrt?igIm!ekLb1&;zw
zr5^;0hW&B9t+9^TQ*C;AjxR<or)ib4ES?`@xdIwkcPk%)j0QwnzS16KB`D#-b`<&$
zXi*e#M3P177c3gRk71*J*T#axL=b>ci3cpO8TmLST8@}7e_A^PQpgDyks>N>hAWOS
z=@Fxr3l5LL<%br-0|&)0p`?~&y<=#lV$lFHl+j0mEz1oDCHEE;<6|flhJmqdpenbe
zq2y7>B0r#V8BidJZvsg96f%yfe1>QkbRi1NFi;VKrOm>+o0160WFR76D1V@96u&*^
zA}S~tTTmuNVB0crOkF07BE&eIDvpE}Z7&BEKbY;NhJ)OVGKPS-Na$NWFCUai1S$yx
z3zCP0H3UQ>(|`bJYDghaH78%dK+!Owh=yIoWufhA`Gc|vB14;fHwQ_)K&uUPRYx#F
zabfEM4=J~+JdoL}5<G^3QXxfSAe8}PDo^~#x43b8(6cj>klBPX?hK4pDmJ!QK6O-B
zY~De1Q1BTM#CjE_Qoq;W0b?`(lk+IF+G>52SoxSQy6Qg<5ToNs*#icd`ha1w(hrEh
zlrrU~na%BqgF3NDh*&JrZCH?%cPgU@Q}nrzhy<I6Jq)stMjW#aPX}=hf}J3tu)R!p
zjL_>wQao6rh5`r<wo^-BW#uS}FhhDt5XC)`1n$kAh=78PEpWj@L|-VV^>qwKwgCnj
zV?JCa8$s44+m30l9*j}zC=9WNt@t<(1SGP(ed(fs8$q(#4q!;x@<YbaYPz9MD?nO}
znpF@;714l8v`0E2nU7eLkCep%OLW?^Oo)boMiMb_P<9lqBcCgKg;~ZOKLNu48}>XP
zOc%CezL1)zkA@-wV?LE&r9b7O(bD@S(?Mh(ZEiwC5sNU6*{0mi>%@T22(`U(b=<V7
z#o68?h8Y4siVzjCH4#{fXuWjim>1x{cDw#D4D>?^#=vHB6|58~SQsJNDk0HU88MX>
zg1Kf&EjB<N=#*&;hRPR+mXm}Wt;{zx<_L(!^Wqqon!zD7Q!Z>0_+ub(j;VQVmmgTo
zN*}2Qb9&=C2Lh&$g@_T$sKW_?Qq&K?Ea$M(9fx;ZWu|EMydCxe14YST$0!U3M~zJ|
zxB``4A=WpD`W{3+QW8Nn&S~E)@kTF)83YWqM!7N!uHmd44lHH6IAV820JuMFxSJIM
z(qJ(O1fofP10zzShHVIHMchYQmol8-fZ^V#4Ge-(GE`rHg-LRWn4$(U48Y`k^v(uD
zs&?uO(ST~7j5u+rvQ^A6J;Dg&(1aiaGI*bKT_M;B$vC1iD$xQ9W=7lP5g-u~Nyu@k
zN!bqv8G~z!Rz@^HG^13C0PTTL#WaXLF?xIuQ4gC2a!56l0`l$z;S4T`4t&f)H(VPS
ziI_mM?c)`GIP7Bt@;!ia0a>64e4ilV8n#43$UJ2s+Ep4sBw7m(@dLPFMk?WET*k*k
z5I~K?Dg;cEZRs!;s+|~w3}J>xL=f0WBRtWfA!Lz(iU6|bX-F;v2DZ0T(TpfTosWPF
ziwEn}5ct<VFd-^nL_@R@vr&Nv0TL%+g!oD#3B{~gQ7Isw2glv4FvtYa3-Ix9jaKU-
zDC4Mfg+nUtBi7qT2Ml0v4WB0<1Z#2y28LKXh&ZNj`3!Q`+j!$546tF$3?cS}QAkP&
z>-$H?gv@C3Oe5of0BLL&5HO8<G+_jaMw}v!!4M(P<f=U;0#@@AA@|{KVvJvwaHNVb
zj@IZtday)*)I511x@8gx$l=RzEd+##1kYaSh9V*0jwp;46Tt`;9j?QJ!PTX!U~D8b
zq<9M?DCEfH<gEz@nIDCSGOr>Bw9BQFQ`s=Y3YkQET^&z3!qAF`9CMfM__#O%7bRp}
zMhJ_mLWk@X9j$+aq11Q>s|m0}2sT;>f*|XoJHil<hV94@kVeZR5HNAU1RCdr95fOj
zU=l)QgIJLCiv+{lb3+5k!7z<mAYok0sGk9XRy+*BbWddtU;-s|_Z1eTQ7(!AiBJi*
z^>{SNj{s>nA^~HYxbVR$vhB75G*AR`ewa$1g=h`hB7|K0IIZ-<K;uCKSqSQ`$bz}$
zVW0p*EJi~PX0@oY?ubq&U=l5g87>GzK*WUvD|L>~3c|=!#8?341S81RETf~N2!s+c
zq;QM>1CChKr&2{$V0M#B&cK)_LxNUGXxDiln$F2I9t62Y`^hjcjq9*5JY*4tdnp>O
zOM@ZRsJ|b9R9rH|7DB?|4o{7`Kp`+iegJoBo9X8UFih>55k%|RUC2WtSA^CV&IJWa
z9SG=&8RiRtXwrwC27!YCgB%kc-a3VWMZyT};OTG~3j!j+g2+cR=lUTTjC1Y!2SkUg
zK8KrzA9@-DNR&!~wsMwpv}uQNlNpSV(~xn*UZrl32GTBsL4X)7H0u>03FZ@u*4?3p
z;SpmijyZN7z@1hjA($f^@56=R-H=o`u$qz;qVH*@ULiTzIz_N(E27#uK+<b?;0b|P
z-9G3T3l#|&WTj|$ryK?r;{q}O<OHo%M+tj?XyV)I3?i~oc7eb|9-`ec3w+5D?UlZQ
z3J8nQ0I~L<{#-;eI(!U35cg&_7*enpL7ONOoTCj(g^@s1zoD^0Ak@%KAs`}BpsiXS
zHLc@_)9}t40;wcgJKE?(GXkVhlK=vwQ8tPIY1niEqjOYXnu5{3F&JQzRi!w{)PK$q
zJ5}jms2T<qXP}Zl+(!WeY_!i9!KSuHwh`w7DMh=nJ-pq5fM_&k3d6g0j?0u($86AI
z>SqQdRpd*sfPK924*`>o*%8ZBdQU0Z^~X@T8Mq#HLI-&u3<DX#9E$g&2#kX?LObhA
zsP7{-RdAuwdB{>R0bIMuMSwPiH#!Q70I40#1v3eO3?Z8^i61hKSSlKBjzVA|6$COW
z9$sIC!8Kii1OshyAss@z+Ih+tkY0jdZtGSALkyHDB~lqL#A*YTDuh5RM2?O!z~CZ8
z{YJ2?b$tB_hgg)N9Rk;NceqV_%;yBsWsh6j5s0PtPl5?mvnT?LOf-xv>c}oi+a_Xu
zNPU|U<pdD}2d*R?%-4+el);cns6QJrUKnll#sM}QAViR@acl)ctG0rK7$$3qflUaF
zPNcw)YBDkbK`gjMl%X#JytVORgw~r$1zL0F=rkXU;!WOk5QsG$Ma7|4!0_HHhzk1<
zi8Xr2L?D$AL4;V1QNIstI$;#FBR~p$2Iu{lPa$vK49AEOC^ed^M1V9|iwVQN;rk^5
zts*pQz$rl+pBgvXBVbbhIhbde>=TC3IueNp%tSHuEr_HFS%~I|ha2KyC^gv%jX*5I
zm=pozvv(BA2ojhap2~#5MHq)_zZ!Ku;?QZhS{Me`a8v>Y7L5qrT#)*mkhT6%Fbacf
zbSDS~*KlnGf^2n-U|@cl5{ed)PPgYGppp#jR6COdt@t@!8xLa+M8qJs-VKL!VPH+B
zn-Qcd;ApF@RJe`?X}InVN1(>H`w(a)SO|A`Lo$ij3_5OdgaM}hW6J`&Qd&Yo$)k`(
zen90isz4Io1XaKSGSWgaIGBJSSrl~=TtF7pl)*ylUMGZw{I6J;1l}h55tVQxiUbVp
zahV9g5skv|ZYB&Y<pmi<i(*C_A`l=^5}~E0%FRIb$3-FNjb9r1A)2`wF%bch9ISyx
zKr||=!${O<!9NTx&IQ^DI6{2Lom-=N2MjJAh7{~2iE@E<cVKia4*}9--T+3V+GSvf
z$VQnd3@-IC<iXzwClLf+sKg8LnK|SHQRb;cYYrXl)`y`~J7$ge1lP_{g6ZM->?i`J
zQ8WX?K#3M(wVRv3Bx>5`0mDGTBPuZ$ERNp25E!Yc1sTtfh=G+H+Mz|nzyWi4E|nqX
z1%QY#$VD2IQy=U-RbU<_rZS4)o|#6M)?kQbz5R~p`)nle0~O11%2s*@#-LOZD)mO6
zJ}4TIfQyih=VEQ{%^!hiKqde@BMPA~j{8y1cGhq8S`SJO02u-ZlyeY$0FRFz0J_iC
z0GM>b?2lqqT=oG#l)Ta(!U*a6V+8F-Lj>xx^`@lX0AbjH)ca@%L47uPf(`5(fsj6-
zf~yQ6;=c6dGOCG+JU;59YCaop1F?B(IRp{6&b5z#MM7d<#W|i{2plAgMcg(NI|i6!
zp?zB9Lc9?8IJ6Bgr0NVQ7_o@`+`us+Ppp@4A13dRia0V}5V9pAhNy{Cdx}6U6@1z3
zpgK(2!Qw2!neAx11Mb1#5`GZbSLzScLNtG<Mc$$+eh4N%kdbYb*G)(R18ry~Ah<Y^
zEF4lX;!~@cx&zGvWc*-t7}pI8afmhHBLu-lCKUnG#8o4JnwI~7Bx{f(B2a6T@gP8=
zfe?^Jbd+1b02>hufrryj8HQTpf`}t>4Zn%~jtHOlj76a&J}0dIEgN6Mxz=GeeDqcS
z<6+o;oH-R`^7uh}A1f5;xqhv_#J9Tm@|?ceF-;N1r!3$R69J{Hf2oGA181R6sR+U$
zaKhA2Bl|on%5zdy#vI!nP@Yr@hPeps4(JqL>$J#$NYs-mB~beR|94X2z$^0POIdu!
z0i?iusjhL3gGh65hzP<MOgIODYGM%}P)*GO2COxYgD3XR5hYpn<+b@nI8M$&b55{z
z-vdFpNlXKQYU+g`V2uri{>$%e!&E5(BEu*Yl2a<Vv_L6!*IPsfD5**YqQODMO_UpY
zu{*#ze#(*#B2bg;0^Mxl#p6MK#;6>MQd>Ta6o`iN@`pjW7F&7C5>VBc@)Lt_GZ1Zz
z-r)eRcv{=ao^2SlKdwt!ozQ6YRJ?tu(!Zto3lO1N20oYS-+)j}!(dEsv;GtgAeb**
zhlio7vpy9A+Kku27r${(j6uqwmw+SO6^gA3t{#JvTcI2zN-X})sV$aanT=I2I6D{H
zVIaH2<x6Vuyyn=<VGwOo7vNw{!ek7D6Y0Z%wG~5QpnS@T;_{S~RyIX1Ta`SF{DA2$
zdAf`$2!$LB%Fd5WOCm(Hj%s6C_;^5{pWGcocziUN+|{4`-{U_x)IBzleo#<9Chf~Z
z@Ts>1KO&(RD$}<#pXq~niceo($}d^`uHR*fYkW%UcT<b6s4T)L5|N^HsQ%i6Ek>{f
zA$${dBtk0su+{H=?czrBeFRFgn8u?7hx&mCd#Knah{;*tM~n?om0zA-lqD$2FS&I{
zaR|UB-a*FL30{?6u36$Wc#*{Jyg)qX!Z$}Z+s=?<30S^7{S3mVz}_y#4G>3=a7Blm
zi(zA#^Wu9MUx83<DhC)-e-hPzvMozIekqIF6(6c@9)giaLt47mni5%M8e51QYpt3c
z6r+7Ds#N!FBHElLo*8>P7~U=k9|~vZ!YnKcvu&thq!8K8Y-qB3H*%g76EFxj8%@JN
zTPk)qw=c6Cb&kp;xdbsM)8ZP8&`td<3S*aQr64?A2$fN&m*(fhV(^9eBnqTY^b1Eo
ze|wWX_gNGeRjN=3W)M9gNZveqjRq+W;PERckC&lg7-9vik+m=1;w*j1zdRLnU0l#!
zJL{+7{QjjyczTWDUSk{Gtv>ktlqp>S>Z*AA(v3`hL1uE}+FF2rxm9)gZ2U}lJcsl6
z+q;#eISiqFz<dC-=c1@TEKFP_S(+oYl+Q3130;Y8obScQ^o)kA<7-R2EP1v}gO1eM
z&bK9b4b@iJgfCV7ZeHa%22>LdbXrjt<~igczV;qcE%-7F(bJqw;=ACL_C<o@3`;vy
z{v|JRxZd8o0>5gmTkTgk0NeSlA(!-gM$_PO)+{?m_MyB@3+R{Y2~I2eY76HtKF9~A
z3r!UWHvpYD4a6k3p<!8kx8J03oU1rxaRt{=K6qb&%Nu*P7|xui-#thjA@iRu2Iw3{
zQfexqVQh4_pP&J-Ru5W$%H7BsBc_f$m(faInb>tR9BGx4EW5_%bDF;lBP!>N?q<1*
z@93Py3#jlT<-7O54XN5#e!;r|@L2H`n0PA@JqE(N{Tmg~V8Hb<Nzf|QpwI^${(Yzl
zSV5zgd}JxqBA?N#%S)Lgx&0Hl<6sblinC>0=iuIO)nedz@hU=tym#=zfuR%+tA|?=
zYDkD)5h}9u8<gO^qDNId;ytTBxJqM0ud!Zn#=yAsQt4b6?=QV`NeBYCa_NN)gTFmZ
zX`(AE;++xSOouV)_t&&WGR}9W235%gZpP@?iCcf{dkNeqZ{cYJfqEry41d>F=<*Mg
zDQQdHowy<G^_|oz;&;rTbJ*w&W{t}M0nvyz;<2ulVe+{CDT=np4{B{$9`y0KDVl+2
zjw4;^@^Cbi<0neE6_`DXSSK;!`~4){z(6)He|Vi${a#JPC)6Ps%LFbMoa-jVpxv;$
z0PW@FF<COH&%4Lge|y2rdKW767#RDhFKm<#O1Yn)yKiow7%>^?G5bBqGK<s0$2}g5
zUI3lr8u2#%>kaY&Yhb0}CWuzife>)n1!Dm0SK9!)hv(j65EbQZX8zf|er!CFy9YQE
zWMOi*SCU5TaUM^Op_Q{bM#I+-E^%2DfHwN0gAT7fV|{wUIlTUe5o)P?@<0uT5Vrvb
zeu2TGN%AvW7#$W7FyO6Cx?>=G`|=YEC=3ggh}Dk1p+;8Zd#G@|mDel*3#b=+?LkOb
zVw10TK(bpngGRwop#L){3VMGw;AX3y&jSmmw`<a95UVu%29*oH4L4dLx42C=m7wVD
zN>b;Xh)p!ugj+zMTA3@9Dm-T@S66oL{H}f}J$*SR@u^O~#Wia2e6qI|4d-}&GS*vc
zzm*IZ8Eo1FpMUm(YRvNG_Kdf4Nt}c=H#lS1EAsygFP`V*Ilg6Zrh2dp2K1E#Eg@;+
z8U0rvQ1#-<91KBw>uuBntC&yvJuyRky-ydcYiDUR34>%Ci7y7o#eNg#%$;e;LL=Vz
ztrasMT^mlq;POX_7peC0HeHm6#@X2?5IB&_`H*uSFHS$YM>dnB0dp1;AMh;5+N%Nv
z_1@+eB?3?mc%l8$)@}@zj^h>N=gP(XAW$f~M<a$Mg}wGLz=&^YzScdmPVx}9(>3`w
zR5$yi%Nf#|-2Lp&P@~m`dFCX!b55^KBtsE!DG_o{!4kX-wAN|moO*BLLm416>!lZ{
zt?clfOEZ1g&Y=yPa{(i$jYTic0luvr2}D3Qe?q}IGVpt7AK5Krq&I11MgurG>yF3c
z*(WQ^-Vn$Ij*~bKjCOBp2WAn_Emv$o7(6;G0tvEnzo4){!_g8tzg<A*o@}d?3k>27
z3!-pcW^Z4Xk3wS*aJKIoa5i;tz7lY=->4Re)%*>3&+xIV2iVze-Rr<W`DpA1H8I0R
z48#t|(a|<Ui1!Gqt>b<x0BfeJhxsrtu3bUKKsbDS_R-+2iJ^0+^0u;h!8y1MkB5S9
zW&N9Th;QJ@dC!eB)7n_1J7ab~U?1cetee3r>W<P5)bj;zGskZ*kj)KTVIX_>i)MlY
z6y9X^5J4rH2xVr4q;qW0=d)Hv>oJ7x4Obo3_L4bg?d<AJu;6YoO9F<kO&x!hN(<_i
z^EdF4-`mWZDhy<U3*~SYrb*54?#phpdtq=E{Or#CZ3u5zsGE7YY2VgR5NUvYx)B}-
z+{&dk=hy~SlpB`BE$pUuj%<6ozjKJwr8<B)(7jNBXY1}(7_Wr#wsLmQIpM&2;$~td
z6sAtJ6)ofhZn&7Mwj+S*_2{7~!^|~kAatWXGsp&{UU>rb9bk2O83f{VEiWX*F6|l4
z-+<t2&j2C@0_gfN-Hizr#jkGe!a%pOw97fbRx=8y%?Rbd*dZ2;S7QSVi1$Jxc4~_a
zuf$$6I(Xs(d>rj9*HIbe32>*~xLXA-qg<IK!Jr^=e<Sp1vya~7$!%cwgd24HQaog!
zg$y7>YiA{$gX{Oa!}jF&U!%Zw6^}MyA_mA!@C5i~F`S<Qb6E3lDhRMP-^pO44)tl}
z=U6r{w;LM-UO5~DL1JwQT_5YcH^Oe0noSX%gL_+@<p<G=kEVRQO^*HY#JE4zJ-S9O
zU?0wYg2wmuU;$hzHj42;)wW-o#q8Z)tA7Hpc|bv|W{YK;48z&}KoV4|<(gi&M+e+i
zHk$MWi$Wi%E#$~=+a874__q2&0RnOO9Qv-J`QkgA1a@5@i1OFdUR2_(cdH;ETnq?6
zc)WfO1%ZO|r=o$#SD{r#A6MHzU%1yF3!GDMakK`5dcz73WZicAG_-RjH<o2IB#!{<
z4EXl`Hrjj%mw6A4Xk%8-=Ep-Z;B7>DARq?~AOsX1VEN+iFVIDAZeKhG$mQM;=gghW
za*^<@%y*+O_h*>50UhC6ukc~e?rnM16%4?&3w_R+ycNr1P_eUw$W|J6ka^t60;<P7
zLyg#@`E$JT_VomA^sCn`hnUFq^kimx2nfdQhYt*(Z(o*Ybe#+0Xy6YB+1q2kGitQD
zeMAieXo(%uZ0{Grz`3!N5(MOQC>!kI;qA+EA=5dyxy|=*EM9EL#=v)HFxn6ba8n&{
zOI_oL@ivX&ucSggMmN0zhQZahmD6b$2shWVV8HCR5W|()Hrni+;~Vi<Un;{zhZ~B%
z4VKJ-)`=GTiZSqwn(HtVxb|?0rX(7&L8gHzfNOjDo!grJn=o3}<l4q>7~X=9ZI66O
zoy1V<7N+Px{oGG7DDb8DmXy!BQ2weMNuqu?oW-8=CC&wLafZe@vbkmNK=3B}T%cFw
zj}A3rD8%w1Nf3M=BbRt5UlzM5VUYC)1n}VDj^^EcE}A`V>Mr={By>i!w!8uZVjHAr
zN}?f~Ee-+c$N2I!SPR?R>K!Qz7QZ1=4?g4F=w3sh;qu%Y0=g1(jvKhiYH4T&gmRAr
zqfE|-1(xMa$9VV<`&nSmBF-!Va}R2@N!&TS#`{B88sGZI1<<-O-i8P2(7gZ5%QKw(
z^=?aHJ=;$g&|z7Yx0%h%7%B_hE3%O7U{G!@Aa+hO_{|ycdo#9Q%iKd;bg~#ceoO<R
z?H_5wbvWnHzu5>FHZ>a2y`<nJvAuC2yr2&J*47zLLmO_wmzm-$gM(Kh=ML+0rS9P^
z9bdxW?Z#DK6!J|SJ_`AOk&Sm5V)n^=xLCAjiPeUE3?^^(GNKW2*b9n5#9<hUM7!~V
zFC=U;=?)4zS8^T<h>HsnFyKvZNMqpY7ui9}cCVnN*pCL8*95V2cRw37UX_Yu@E$q~
zdLA72?D5;y?Q#qn{w!w^M|EVy`18B^rS$aWoW!R({T4&r)4MkxK{sE{OkiV?aH$Z9
zLB9S-A6N|>xNo56Qvg%9k>0{luh$h18VxRWgkS(fZV4Tk<4FslbAbJRB+Q5AY7npD
zk*|?HycIxejKx3*eb%R+hhQ~w4VJe;Hn5D-Bs_<^)TIYQzr`)b0K{7i2b^PD-Qw>Y
z-KhT(E>v0EJ`bZ6<q~gE5Dp7}n5Jdn#4ZZHo@s`QNBeKl*Z6!M+|@%s*FI)}HQbK#
zZ@}h^NB!b@E3arWSE721pP?8&nR|evVu_sK_NVvoLaMp++c~IVr<@OjY||2BsO-i;
zGYpV3eQ7|P9^J2noLe3{T}Y6l-agC<cpEjNZXyEpyA3qFL%YE35061etcvK{{JJX)
z4VY~SLZja(M8*sBw(KwrK=7y1wYoe8#3tW`is$=JL5L-(xy#PZajma1!w|LAwiOVF
z!&C@2P@XA`qTbn^27MUVT17@2MOeKTiUIL$a83jAS-fX%U`rZJ9F5ufkK3m7Hdvd4
z7d*c$9n^J>Y?W>payL`w19faY`-d29y{(-3g+aL1;O|^p-WCQtVW_vVJ=;0)uv@B1
zzz)(!3J16WrLU-feKu=rW1W-l=XnI2+a=?keDi(F&T+l1U&C{b@25C+(>~fW3~d;H
zQ$(X6h`1o??}A9t`<h_mYeJt=5rl)UVZ@gK4~Hzu;%lX2+?Ep6<HvrC)!$w?p#k-n
zG5@F(zWPyl#6&>V&({OaKLwmcjLH6}{|qJ*&K&`aQ0a4|HjocuaV$_{LSZ<fIcgyp
z1>X<DAn>DzhlFt@#{7p1aiQ|`a>f#TkGqVdepOMT?OXcpx|b)Fg7Ir(*}=?0t)K;9
znC8jlnu(fHK#oS2f!YAZQlvu3LK^s7X{ZQ&PI}11XOKlgGC$lxwn47lL2XzF2)Q3g
z7zCyV-MZ#)91R$mF4u5YC<VdEi>>Psj09YWAW}hq`j;Lc(gUPI1O+$b!>Hl@(F0KT
z*#e*~<{gQpeyg2g!5iqg6nYD6|DDh|r0GgE=a4WPu-jmY0wJ186GnbD(K`%Svtoq-
z4Rx>KMCPH=<iID4O7(p-iUOT8|HkSWXN-r`@BRGe;xdyYpOY-9lV7wr{rR;_^RGyk
zmRoRtQgJyRwluGjvewxC^-X0BXM!PEW8(d))e#h7OTu4@tOC)>2ekNlP4Y7^cOSGv
zDwB5Bq{wjT^>583MWoQDgQiXJpOU9rnn49-4?EX^gJbQ7&^4^Zqg|h~aK!6DY%Lui
z{gjaddGeg~uBfd2&<i;4I?Gq*()K|wJW%sd90<7i<N-s{R^mA4)N8Q~_0u`1QJjQC
zuSYgGwYbi~t-5;W=vESG3_V@Rra_2zR|zC!tC<55V|(!>sOZfjMB(r-&BvhIocqE+
zHW$cYAe*gtITy0IL;(cUPf&MwM8BYlu#lvJaCpYAVi2$C+xQo}6%=a~8zh9-fx0rm
z0+ViYxfd8dz_f7q=70hUIvt#;m}AJ<nqzfNyQy1n4yldAL2HD|4{sR4Hfz+-pa~#`
zu9`Ls!mTL;RM!tD#OGn;hY<@x^-Vusgf8(*GB+j{pP!5Jlzd4qFKPAVgcs(n0Cc1R
z({CbCAk{ZTfgkxYAUxdVo5b&Y#t7v;=Ta(B>3<7h>tDmUh!|s|uL*b{2fbmJ;%{k|
z#b53u{_-5B*{z(FoJ(AOOY^zO%lP#5rTlU&s#GtN^cqj;>7LGJu-24+G~yzRA`waT
zclFnmsSiQOpp|-I>La8=^cxgsah{6ocFD(34Rm35yrV;;&Hke=WzzghsXs`cGMo0|
z{ijM>0(Xl*7R3O8wo6bELCz@FPXKdXuP{wOlG$}FAB8iE-;=WPs#jZ<GcNr|nR-fj
z<ZD%4)N~_!g!^LPH|Er*V>lSA=OEh2<leL#nfY^C*6%$t4>mYvXyY9--`aH|(YDk2
z*Ys?>C&j(L1jGkrG1nxr+m(zglk<diY&mC5d}6+p$qB%}-qP}`-SjO0Az@LDf)1eI
zZ95+Z0&5T^0g1qDTnrq>H3r_!uoEH!g;<0kWkN~8(qQ=m+$!GgGfUfqVLn&0HQ+#V
z!L7Tl(pU)U2GpZubgck_5qCbPZ^_wvvJ2kafx}Xo<&4+0s;nhs2n=2!B-nZvBc!hP
zz8HaYy%1&u@?(cS+9A8y3u9m_uBWtwT%p^-d@f^shu3z)+u>B4#z1I*-@f!Inpte7
zJLKx!Kw}`)`oZiwSZu`}h@^F4<6sTX@HG5wa3n+TOGHDsQSb*6&7tvmtyEBnWPfJe
zHs;}~SxW?ta#=7j;I3&phHNec8tplxpF#+RB^T?rs)Ns5Ae#H35iOx2xW%Lb?sE1}
z*-u3V$7g(32~519k~|e}K(rfULp&YUM;JdTg@&RZbYZ1;yS+QB^M=XY88Z!cp~#?;
z21(L8;8#V^Bu5T(5DP&gV%~`eb-d81e2T>A1=$1#yBtCy!R=gmV)LZquyziDY@*<}
zR&t^|kY%Cu$P$F>Ex2z5-g(uvoDhR}8^uWskXtV#7|dQV+(-Z+i;*KcgG;@MBm&l<
z@N=8>XB!NR_y~to#4D-{yfY*Pe-?zxZ||QQbOCr>LIb=~-^Bp9;D2DN1G82M382vn
zqH{B9p-A{xr%%dgm}k|>Imp%U7!2Ldpz%w6zK~#-G7V_3^94BPqH57yi-EQJ(mPW4
z<$8h>)|KWFM1X+(pbMpI{9f;I#)P3UtFL?*WHfsL03j!C?RuqM)j7b8$pZ{I96nFP
zsGa;KlLyWjK8-NX@9LM*)0cA+pX&5mT%$+DOV9WqwEa1p&IaS1!(DAA13<TEk(^_*
zFU6ukMo!9B5*-YHvuy?-&^D3>G?dHjp%{K~bqA-_&H_pTAq5eUAd&iKz5;c$w17rj
zhB6d=s5Bx$5b?+w>c)zSoluUyDDoL6Tqy1_LSz{9z9!t@+w2AhpVLs#J~3`DbGw$+
z$CS&+GvEIn(lCl5KMEv^Bp>X;81I@eLK=yX43~-AUWiYmh|m_)DO`;B)c4HKx4HoZ
zLoQ{Gf&hwGN}s9ag@{8a#eH9TmPZ7f00ZD5@rCfrFSZ;5Nf8Q<dtt<g<q@hQU<EQF
z0}i49lavFR(NOp#z=IVjJ(PH`Miw5xI54UrYeeHd0R})U1t}1KN;r~s07|K-578`)
zgFYNw19CwyaG2!)K$>`F08Hcj)I^|;Nm2!55Hq%*04xlB8Bj!8jY2B~QVm0P07N7b
z6pKb9L@2^E%pMTvG|Wl?5KRmL047N&v9?WnFJGO(<$7uD3?$bpYIR&r18!5GI^cyw
zxnLPZ%vPojK_-a$A}nGN8X%ot)={uB5`esuR9P=9N-6ygJlibv7!?%Kx2#U>k1LV^
zv3%A#gjf*`gYXN;4dWRBgF`lAB#tVAIYLe&j)iDqv0y+U8is)QoT5cnghU+aUi~Cu
zKtRN)Z;_22C*>Sa%3GTNNGvcjHOaMLI5?7a7+i!C5kV$`t<1wk$PLYSi0BK63@z%Q
z2Qm>+ya=HoBCH_~ad43U(J}IX1|hJ^2CHPXpuj@YkvT<xM0ptckO7zFGxISF^aI8a
zjTU1vgtQG!TazU+A|#W6h<w4Q%I3oUQxp3HG9riy{n)yUA;^6c$_O&17ZDYhp$%hT
zwo3#)1*@}7p1=@5jb$AHQ^+I8Y{w^-4ecuA7d#3$m3|N~`XekT^ZilN)#&{ahFopv
z2buB=QVRr$m+H5IMWl@Qh@oFARfvVH;lmCLED}lymK1VH0<c1SAeaR6%&nw@8LDv&
z9!AW^4;EO!5V;8EZ>S1xLM%ulI|U<BRHfu0<P*v$5yZhIDOinRl*%JO8U>*+%$qnu
z7-U1S!htn@VnvXyN#KqH3e4?{JRy!)`8<rkXw@(f@yUKz!$Kg{u&Eq|P~*281X49p
zg-EPXnhJxfAsCo#pEPP>Q47qFj^0avXyt=N?xUF#97>JfcsGc3$n)-~F&Tzfl0epw
zC+#vY$R;%h1XUCv_ibipT@>75I5-q}1WHXh)?jEg5iA&FlSVNZWRuQY1Q8p)*>8Eo
zBcAIgUFH~M8m9IzLNyt~M4;9<eutq}oARKk;Gpjv0nw;S69UpGfrb&O(a<;ottL_q
zL#%P#2!UFYfdvFm<FYLRCL+~;ZJT;UQ6PCBR7~cpZ<6M?7FVH5-(SbIMXMtqH7k%U
z1f46^QAKf|`;idA(%PFIf^|^sXB(i57<dFSy`sll*a_!)1)B;%sR~7zB?GzO;h2G3
zgme{=Q7`KOut;Ew%2)15N9|OKi2KS_E%9##*5jiGtnRZlSX;8b6Qc1qQN7|`Nv+CM
zm4OR+KUt9*HgR?lSip(OmU=(=sVI}jPx|<{z57&I=Ac9waHd$U1R>Jv7(<KXY7Q@F
zfgiDcx$zDRXyaT}$N4!f&$h(c9oP)5pm3RId<V!?kw0hYskS@?dKj%NUEXnuXdWQ!
zkEy+UQ{3`192=+N<=Sk`63aEHQ;~hCu5k{uDziPDgiRv|8K3im0JIu14}wzqaxPN2
zbA-obsb%s_oN`J1NHU*MN&_Z-I5&#=H7RFe;5w;l^ODN$LNkH`A;`()TEDkf8gU3U
z3(6t6CSOE|ki?gStB{DZAO7>7i_45O$Jc9;pMTL*0a5h_;xw<4vi?<HsQlMA<=M_~
z2s`Q(*}v&Cxk$FVN4q~IPq#FKCEiH%oKvm`3zc%K%*7_4b98G)#W}bSdjcnNi<S-y
zo_lUizbTAF5YRB7l1srD+aplV;%lYPVLuh+IVl%z+wx`(0I|ieMTR(B+#-V$_&H?G
z&DR_waX`86C7*s1mw}4XrOq)JSAW~(i^%UtNFp9GU;66re$@Y(-*QiT_%*@rC=r29
z%q1l<l7rW;jY=-(LZvHg^wR`9P)UA2hdZZr+UMOPyGgQS?UxcSey)?!(-kuBd*%7Q
z?ehm`kuL;MmfR1ih!*p+hy{Z3O%js84`shf-NDS#Jn@t-Ye8BRJP*P*CgV?q@TXuj
z637*$0pa$Lj21O!M-;Su4R#L`gpiAjMk3==>G`(zS?Jz(!TJOoP|o$ivOdw!PR=bb
z6oh0gFD*7i9SqDixN=4|EPh(JS7#JM;-@mse#p4@oW7w_j={;=C4EcIo=&CWr!4VK
zMP4U)ZRhh{@)v}RojV0ONxI-pL13AP9Tsb`<2azhvx{T{5xrS6g2d9X%7QS|L}lT~
zh$ntig+(Kp#h9NirHhaYDI-avfG@Y}PE+amL22$YKU|ETY=?S6CZd3GB8B>^uZgfw
zQ8$A}o1PqhhHP1J`s!Vh^5sJ@Dl5OcKOyx}mcUk55999w0RbiP>D~KYlxM48k0`MT
z)gLGV%9xNm_|4#07)HTN;jZ?saT&jq@%7bv(tX=;nI?9X`TZ%$)t}C!#bk$DDWs@Y
zXOY|1=P8aN@Una&X}aJcV-~ye4<jE7lr%Bls>0z~c`OFbch?)ie4k0n)y4<Nn@@v~
zhqh}Ujtjn$_?+f1wr@cP5RUo*Q!zeVR3ljA2O%7+j-Rh35Dz;{DyamEQtrUYIL$t!
z-*&`uca*KYJ*UslNvYHEs(#NB^FfOvj9U~ji&lZ-7+ZLi`lnOvwFM10fa6>oL*VX_
zTz>Xc_*MXs?YStw$0{@H5Msvc^HCBWn*|X;sGL2V!TTr(Rdre?7qEz=LziCSm&CrU
z@L1CV$J*)=m-StJecxh(@nHcS9L?6v3M$-5w1<K2`>Qf3)ipjP-nC5d(u&P0isdfK
zgUk088hw~Q?vUAz!5jszjZo7f2lI3H@Bo#c7AIF6zY$qV9)OX73u;=Lrn$=Knz{at
z)PTi=?imwFZv+dXfxckyv}-c3+8S{*8_fsXj?#fq0D}Xs-;-gx=l>`J%_15y6$w~3
z2DvUCASFuc&JONfa;awI+$^ti+&sKFwxoa*qV{niS!y0iK|(l(yRNv1jGae{#OiB#
z%k|SyJ5Sd_1&m4`Elo&)>3Um%?TLi_<LL1_7nE8rw+j7yMJ_;Fv{0t`NeGH$G6!1U
zi+E5Kt7*yNpGX>9_hng}fZN}8Dq`qEAaG*1*!+P4P_cul|ABP`-utrP9(V)^LSb{d
z{HQ2L$(Lf`?F#HaSR^7I*p1g7{Gf;w8Ssdz--^`MyxKVdC2CF1ZhKen053IZi9zA%
zLYWBlIe4Z$28EKd4i$=cjdH++!;jP=&Gp+um6YF-|4hEOi+W(V+^WbeFO&S7l*!p^
zA4|Z9IckJLQj-xhSPwF95aHBjGLhn(!GnMbj$WI!4Ai=M*Oy|u)b`-E8Kk1X5E)?3
zc6wDJc+!=9Ks%_Te6I=fk&+_gryC3+Zdx15O<2xap#Wu|>!C59vOU=15c3Vu2kXsf
zTnR()gddU6qO#`N*1#ET<G|H9VFhO_46F~YyCxx^Z1$?Yh&^28urb~_u1WPCBZL-I
zQqBR_MQk_WIY&Ahrv3!h1UEWZTfl*#FPl*{5^cBU>wf}SrREP74vZxR0VmthoD1G;
z2Ld3#UJL^l5Y8;tK_Of36&8+c{rJzap1QvQnY^oG(QLC{9|P`WK@o~x+@FR4AK4e`
zy)f{UxTP<*;#Pg?D9W*B1+H*9de=m?$-1tapS|L_7dwL)=w(WxXv+2&9Tv}<r&v^U
z-TR!SLq0Ccob0K>pq^R33<lOkPCL&gjkiZb5z?sgfq{5qf(--Y+9(FL&#_%-@7hHI
zI`jTA)1QHafF0qz5)NRcWSlRc;F`7xV2R(TdgI(z&kO~juyVmT0}9>RTqFv{X=e{q
zMzFwaBvrBLJ4506b6Qrl_ju2R18CGUi~@GyB@b4o<~B$`AzTzsET=uscBHi&>x;%P
zs3{2Nghhy<#%clAIdg5cg`iM$K6?QX#O?ta?k(mH3`s*;%c8X7zn=fwS~uKP<DCN&
zK2xa`()NtW0WA!n-#Yw(fpW4R&N(|rPxF92VBD&V!pR^AB%JMEo-W3~H@o^51KN6N
z7ft||hqX}@clM$o2Jx1y9tOV2#1#mv@jh`BQJW4DLlr1ks7N5}HhCRfGX=eqHXW_U
zBHN_Yj4Fag8zM2R%;MStD1tWLEudf>30pgGoC93f9=LdQ66T{2&}fA&1`U@lZ#gHX
z`XHnNZze4-blMBX$4l`|BRhXa%3L2+KoYujq)4^CHCKlK%Rn^0A(M+od!XRW&(Wc<
zcf54aIj-$RH&EOiZ!~qDq1?N%0FB=CNE(#)m`&875N-#~D6HO2kew^a!sRj)Tt;Ua
zvDr;gHQngWE(~oyTCi+q3e-;@sy|f(lrbTB@S72`FpPphJI?651D0#vY_)T)>yvA{
zP--&2#R`MRGkq=?z&1OrkhV141G6MP&#fZCpy<q6I_HF&>Hl($X|{Ug9@RqO$hqxZ
z+K26&Vp|J>Ftl>*cnlcAnd`sKrEk3_5{rOgAXFTQoEMkCPnj$0Tb!GkQ6CXpl()K5
z%Q^LoYxx+&oV<5o!1}n)!$JiR*pbX^u!6!jKGY2bu50Lk+d8-A<D3TxlK}uImTtec
zLcyIiFepA`a^?_<be-~=w@SEv5kWOG%Y|pSl}7hPl7InMCyuE5ueX;@U~rhLKb_%C
zv23aeYW&qbZzC<`9wI~9P&6~ijmS(mvur%5<ebCPM<k@mM?Ysma&ZgoPpE1#SzBbm
zW5QU-xMX2Od>SxeZvAM)Whg_@$4DdU%Rulc#%?A!&azL0*hhh!5Ym?8M*+Q8K`aL4
zoiN%$sa@j(;%{2y|N9SKmF6#*wn9}M=Qa~0yMsIxSr%Wb!JZl>La9%D*jEmZVtlO6
z%jimbQ8r6r5K(S$9ti2I4T8eAX3U+d(1uq;!M7G!Krwq!xlt%N;I!?KookTJiD>L`
z93dTl6KA@hz;x#)A%s)e`<`GU^bdVXMGy``f2Ohl$z=c0xM7v@7mpwJ<JZ#XQvHK5
zQ7C7TF9Zox(h*V-^|12KU?qVcO4h^L8-}%Z7srA#cM-ee`Yj35?%>7}1_A1m){BPf
zkD)x^oCjeTgu!nHCZdq=B@r{P4ml&35jT&e8kzzOz}b?{mFaLTZ%agj!e!Z-b1XO@
zW)6hRybiU$-FPlex9UrBPMd`~Uta4=283=Y7D8nwpf9j2+U-udRe{5x-$%CKJ;kT5
zFQtCTMVn(w-fEq>e|p*Z{?9EP!X7cxb86ZDKxim=6zaYXDpfw(M@f1pdyrO9cAxdd
zG5(r(=Q4f)dQf{b5vafBw=6Ex`rRDg{xg)6`!ula%H17SS9rUd7Vng$r?0v$oSxwp
z>!x}0S`WGOSNI{JLRt)p9dK!xMKTg_Ps+`tn6knBbG%6Fxb^-^X>m@*4aMNtinm4W
z!>B2<@zrt_@&4MWXC=KdQM`>ao9@fqUBX@3y7o(`u9*f}Qh!g9ynQ*Uymz>X)2X_`
zwe~+E;Yxdd{RE8Fw{=P1R3_GHaGL2*&H~;3Dl$Qbw9&1L<l-`^J-B6?k_c+u=C(US
zzpKpQs#x0Cyq0nn{k{8VTslmTRaD;ZkOpIHue@XVI(S4Ea-^#>fZOGC5?vSGI1T&E
z>(>z>UL-gTJ)~%TDU8CfE1goPzg`r3r;`rvXe<^?a4v)`CHD`i8oz-Q0|>&@mjoWt
zN|8rc*H0CZ;yS??lN7EDHcvRDpicNQV3gsxuxTs|chY42ZNj-FX@dYIf_g(oZ0i#C
zH*|g!F}y2Nn<|S2b3W6?KzWbs;0|$2tqYtWW=Z@_hoFDGC6z+ebu{C6j?JI|gN!rr
z6b7)#djJM3!Xuk%`(b6{4>PB0DNkh*Bk2N{G6-y6VUO4k%Yq=X^<BHOv`ns9e9|WE
zQFVf|8|{mAH=6O>R`9?eHUVB&3P4K6+WD%d<hdwk)fIz!ZMR8rds6gkcx|V=LI@^R
z2pe%pmF6wZV?2g0)|EHpl=}XxfBoeC?juXHR!QvvO)-oTVe48UTp0#u=Q;zB3Q`;R
zFo@Wy$A1>*<d^#xA`S%y^=-sg?ygM$$*(Q=TMTLA+^0-hY;bY#nvJwyX69+uLJbah
znpOFK+3VPaOD)=`Pq?5Y;1aG_H&X_4ZfCXhhQi`t%>f1B_9+4>(1_3HKgIcrZR&T}
zD<M)B-NRNf$wM;U>hBz16IrlOX%zXyp6LBGa=xI7<TLLY3TO1Ep$1%Cb*2Ntxer*6
zfsC|b|3GL^Wq^C(CoF`TGMKBaB01E#R_nX~OY{_yIB!l`efYEr&gRW@&0zrR6!xir
zyTmYc6L7>6lyMd^sK9Qm673w^JraiF<a{^>XGRvf`rY%@7gG3G8P23-$vL8yZ^~JD
z%`CrHYNv%0V6MZ%NV_Jjqs|K<8=XHGcB9D|bOK>r3g4Z6JPK4MV*Vg`M6pc@(mx%H
zL8!V+uf5@X?^+^F*G!1!Trnp#Qw%nKjQ8aFo#12TLK#=DK<u1Ls(|3lCC+fc+Hwig
zxrtjU(>Pb!$1^;Tw9SFS5HTJxN&_G7fxC?*yRNeP02~%X<v+ir`ci8X99@elwST&G
zz9<D3BvL9kv#Sb&aH}KT&dIh~fdfQ`w6158)?nn%-TJIkR#Ylo^;Giuth6@G;MVl@
zdwnf~;{!5_*6SkGmJAr{o^IVE2$E~)Vv|c+>2oOEwGl8cF|$_=!<uwySg-L7E)ZSr
zP{qLaQ2}W8xpq4ua5BaDeT&Z3b}}^J+_)_*nsd&<nLZ%r>|306ch1K9lP;X05X6r{
zi?gnW3@kQ}xk$|*Gi|9D?3;gJM#`twCSWjVxW1qbqyuiF9SMZZ(>XwlwC_<f=XNKz
z4ls9=F!c>Uh_))2AhM=0#p5R=3~_7LI{1J+(!EO*?HM{SeD|~p^@c+HtR3v5?Ewtl
z#`~pn#a*2S#2{fKd8lU|MxFwrS|fa45{{J!Zj2#eh}uj}=$vqCXKaALLC^f(y+0VN
z*0;u|ubQ(JvX||*BO_Urhu?==20SU_VEBec=B{y7dvzHrkFV2L#JF>`@C<{e8)v65
zK+d%2W3Y5%2o3|}>Vh%n_RgrM6oZf}7XmN<PEHtMz%o4&;9M3hw%t3&+D0yAZGO4+
zh!>1WmWCmL_pTQ>V2iaL=e*pw<mrBI(OlyuT%~6_Hg(SEIXWUG<dbEFfXQS#bof-9
z%{{~cvtTNU7Lmo`B{#XP^OEQ4igxETTRl(V9No+#lygio&fYnuezghCdfj_lk*xl`
zZxrs1)5^QBb4xba4)5FtE#G3r5dGm2NB2@cUCM$%r<v<b?uj+s4C)-y@~-zSRXlLb
zJL<A+4X=1s<U8Glo#Yrgun5mR;Z`T!F{roP9f#r9S5G2ikZ|LiiE}Z$KhxkK8Z?Z;
zIn~X+Y7Cern-r0dE*!3RE{qE~pmSU^=^q9=H|EPw{RZ3{KMzSrI9zRfW(EfX*!o<p
zbA4Seh{M1G?Co1!Lxv%HlS_Kei%KRfea<<1POGaP#%%pXGo1-$geMJ~&S^IHXocZZ
zXO>i8XeVcpj094_X?c_YL+oej_|A*clX%EE7dLttoa0+FuOJQz{5tf?P9O|L9o?6}
zpql!Rd}{Hab->ExxoyPGQSpdN7Md?ua8opTPbz!WJYu$NRJO#B{b^wVscB|<ugp25
zDZ!8wV(V75bAS^Yf}sWrb6ObSBvHu#UcGO+S=YIAEnXRQo((J=D8_J3b2pBhGxOeg
z0VQD5c?cjIf#kY3?*%#M<;<xi=a`nanmC8H8u(x+!FcrRUV^VusBQV1mr*gOIkSuw
z1K4WLf)O0uXVkzb$GK0Lgu6OAbN(5GUgO~w3|OmMg`JzXiR?Q^w0dj9Il86xG3UVU
zH=Zqoi!c^4o#98srvY2+FP>uRwH$w7q7n6FAo!+>FK+eF#~bPC{$M|{1=|4=PJ@6F
z68PMYgv$CB=2~a^wCAC<pKU?g%93|SH6w8#oHP?V=jzeflIOCxG!JOcX_B2a&hN2q
ztFWW02q{rKSFTz5p|nNIg*Hh;v_i1SWkY6BKRq512BDhW7HMw1%fcBj46>POgL^V2
zRr-=&bd4}Cx-zt#!;rqDL`CPJX#aW1G|xbMeDr|WeP#-A%W>?4Zv0JLky|juFh$=$
zWf`*fJz^sy3VljNFklp;T!l)bBQjM|)@lF89sQbjPQQ67%Q7Yo4V6ey9&pZsFbu+e
zdc{8hS_N`ZNcaTw6qt!%9gEJlOtq+BBv1iE5UGe({mb(D531mdLg4#H{q-NsXH#%2
z6lAh`vwo`)u(gCE__&Z5+JcLK!4V&nqX8%`^ZuQ~tcHrs!?D!>!8VaGI0dksq;n>1
zAX+dhZ6MfMnwdYe9gE90By#1WponJK#pw(jlm=L21um@y9z!EghMI55a^{}!n8`qy
zX<i9;ns?$c)UvDDnTkS5n|ayWskDJ$o6rnT&?u;&nLpn;OFofs^@R+IkLKgrN8zgD
zC$JNp9k8d;zLtC#I3{K2iwN<K(}R3}y%h=;*!=y#d{`E5k2nNAAs*6VpuTFrH754K
zA+<pDaUsol@sRsLfJCV>sc&WOeNEoI?`i$o>rDi<A(lm~!)!=gd%8m$Z@`>~Qjjo$
z+J-6uMZ+M%+v72KcZWM@)}ecxpTS#Qc-MyJe92iElp69b!-IrXqW`%rN?c;L(g?Tk
zynesxEoeHU=ye)B7v;sgPwRjoej);{1Q5ymJ+ca&^;s2f4g=RSGJvswitgejnXRsI
zj%Z-kVk>B`N6c#jhdI1S_J{&Z{nwEQC71>am5^}`rxHsQC@6I82ydEu$>mzV>z(dE
zj2*-S=2rPwJ*Aixl#c=rob{cJMUiIl28s&^jD-po2aTheI+SJM(?Kx`1J+&A^d3R%
z_-@9qAnj!oz6eQxb$-n#U&Kgl`?`x7sXU?G<6Kl;K$p>G6qYSlhu4x(?Q<h~fMMS3
zGc5|ZwafyFyR&5}421W$3?#ExCg%c;PSYA5T-MV?197QOR&}Q|u>4uG(RZ|r6N7eJ
z86yTtA$Szg2<m9^P+6VB`B+Yo=8d#{>XeZic~g$8g^rq<%~l1l5Xvx6{{=9@@iPl*
zK-zP3NLl#M$Dt-{Z7yVPr4N4gF`w5tvMvCd;Lf~vL#b-}Mqu7Z?)EJYigf*ABWhKu
zWiOHuzK5Z33bECL<eYMYcON8RonOT=yxp$Kw(~8`ueW*{&N~OWSfhp0j&+-dLdYk`
zHPH9hAEaQjS<|QdK9U_7#F>^8v4_PatGbFp!m%DW$MxYNP|Fjo(7~M*nI_bzk>+xX
zxpU#W+d5S4wm~}FB+bn04u-_dq!7+!Y_%o}9L+5iPB3r^PQoyP6Tr>KG7Olj&cnIJ
z3>+`g+2H{&^O4nKBhY4wAy2;RcPiVh<N(hVDAKpkFbGA)w%~(mT_(Ycb2XWnW_2!Z
zGmq~WT%4_XA_ebDO5hyWN3+0deaSx8D&Vka0Vjwb6#^tLp?R!)!}nM9x3*yr)eMh&
zK+(X>&HFfK?^2|Pp}R9>3+KL7D}+|lu4y*?h8laW&a5~Wyg6eBMZWQ<g>#B6jBi2V
zg7XcAQ|~B5oSCygfi|g9fVc=M!yqzm$#UEQh@llTPoEgTF1M^suPUQxi#n~g>N~wy
zFqc}3Fwo8H*TMj{)NqGkNmfTxP^`-2k=A)UY*3QLBA)q};QqujTzH6~zNQa+DC}NY
z$%F!tMZV;eTFr;<FO`IbA)ND=><~iX;li$76sk=c?=XNZwen)18)<-ZQR9(_`~Ycr
z@cNc-3@+ZE!H_t)X81AUV3W3S4F1lwRH86=yzLu<Vl!F`s2r0qI}F8`8}dM7D`Zu3
zypbP+Xsa)qP^3euZmwmlNTy`7lIR@a(y%jzv0FYO;GA%imRR?Qrhz7gjho~R7_gSM
zvqGVp-#3l{ac&ckb1m3vq{ATH(#m2Cv%9{a1B!z4M?aiP;aY!=b8t(`9-Wtb4Z}JN
z0W{tI<ec3zOK&kKxU@hU3f<(&jB_p7Xn4lKx3s;@xkfCVvvN+l^~xBAUQBwOFkr1M
zk8>n&<8NY=2QrL8^<P9G3qsNRo?zp9LS=(Q5DvbFsXs_E*;l={<n&8%xy1ST@dNjE
zV6o8V@lsOZ2Yx7+?+2ljeR1a-a3!S?iRe(=BSmH!4VH3^0GWu=?x@oI+?cB-bSsMj
z?!}=@F2y%pQ>tn&t&<B>w810F0k7-`>HC~;s8={1=o*sEV8Ic4@)YwJ;Ie^drIy`u
zV3}MqT`334n#XDhH<H1n`afa5WAF&4-I&@(o`(aCM<n2Y(U*cHLZs(4!9yY_T>3U+
zTrq$NKlB*`OvkxUk!gsv9!*7vfs~eA+74viIicG0=MT*a6fj~Hw;I;UcRpKRTZ-$p
zVhe-q9<pNTBd2=)3eKu_>3<V^eH7h+2v^l*`ZcLv%i{L(`sb-8U{J9i!akS9#Vg}n
z8I&2##lU+lQ>emXOQ?U!G9*kJlII*?TE|&>O8=Jp^ZPHaaT%X<j)w#9R3>q4q!Z4e
zs<4Fm7GcQ&JAkM!SpawEb3!Q03Id*+y=PT$$;(=K$h{VDMycR<>=Zta0*Mr0wvo8^
zlohA1KSc;4L=Z`^iLk}@3+LEYazPAst_LF^7#FLi82ETZ^;{94x$EpO)FY4#1MXvC
zx@Y-F1+Hsc)z)j@_IK@hRVLN7P#Rf!cjJa8^(5djLb^+QmoK;|va_s@02~ZoKNoE}
zBwyj2(?r@ZU_BMt8Mf>ugk+(F%aYrg>c1Cd`nMuianYY{8QkMS>lTpOGiRb7=LT12
z$A7L%{k~yqbA6xb_(V#{Xc$PbM6XEq7HH@j^a{D+0i6ke;G)G*aTx<tr<1?_#~*>j
zYv!d2gIcT6nR~L4$d9Zi&y>9h)gL7S%9xNm_|33b7)HTT2?mE+EA3Uzu?a$S+asFz
z&*Zxxz=-;7P{XtH9&!uT{?1Xid*OA{PMUn3^KYia?i|xhWaAuDPtJ`&?e1}A>H*FP
zHAyTm>P<5p1{fw`re=r%>^03)xNs`60<Kn~Q$-#kEmoO0W(-1Yba!EZtiGr9>9qw}
zzhBKCpdA#?omWX_=1iPZY0_-$9MR0<5QeM|a>S+*{Zz&$sCCQzd=W~@rv3lUG4<;t
z_x1r8aFa<K=ZI#82?5m-yjgMeEz3E&No~$~l4Rb8iXn@WnwWE*PG;vo2sQ2?1A#?#
zc?-_OO@>%8V9giJF|bX#JTYL+j;uL15|fT~=ZMyy;ZfiXUL-LDY&zVBXU(QFw-~^-
z6Fdx@lLr##`Y<yh=^WE?Uz>AiGZQ7wF)fr1FeHAt%!q++Qq;zPH8p5;8K;@{3Qtgp
zXICCVG9Rms)H%AjCryk_noDs`pWlC9l*upp`3ZBr)dVDl3Y$--J16R-qt`j2*=JDa
zsAjAkhO8O73k<OLECR_YPs&Hm5iN`WILEd2_<|u{{pa^MKYLZ(grHz3XS4tV*cSPm
zOW?{DBn%1)U&UzBwo{rg7Ba3JaYTF?u*L4oDJ<Qv8A`pN_W_IQxsE{aHCS7m+#OM0
z)EcjqTAnTUr7tN_;czJ0f9^pf8xS8KJs@_UnL^y^OW6tC_?t*17^8x7qQqG-x%V|<
zL!f7O4AX!|jEx&|o{G4f+tbXWFp|>z<%|kO0<NEtls2h<Ss;qiHA-1HQos90547E9
zllGx@srxC(GV?Z%-JwlrRln5;w9<#j2gfx`l+Pt2q3C8_{5Teu<+GzRqCqj!yrIsS
zazf#<%!OSV4J3RMVS`cvfrD$}G9kFgDOZsbTysvJiN0k5vVRwKi>|%0lb==MR)O82
zK9})}cP@*ocTVE7_gt!vfqLp@>4&r_r3KhjA)AXpP$j;uI9kTnYf@HTo}7}ZipzH(
zh>hqq+N)E|;`aHiSqI5tXKCQ-;lh_9;v8xvRGMEEL!Z+mJ3~E}3ZI6YBi$97n2|KE
zi~hfZN!uWFg4>IubV1P<Yh_zw=#(RaYd+<nKGOxa8sYBwD@bcwUE=1pt;UEI(5(d|
zh_pir=BoNVOU@tnFcr?Pw<{X?TEgA(GSLr`3T_)P0g-Xw94rmX0fVhd<|N)Ow;s{r
z=Hza5jYnsdoijF16vlIFT&k|=LIZ9iJUBkLK>!Z<bSJIPkOFk>%YX(F&qoNtxXNeH
zU~#DwGBQsbj^iMbRGrhRS@3`MUXna1)05Zy>uZsn@p=|jqLq}V*QQZ1Prf&$CZu@o
zl9Vq^@yoM(t2_!?d(+{pf)K=DbIE1JWfBAB|AMQp2qYTySR_?$h!lcsmozabw-nC7
zy`S9jbJ4sUK9})JllHXDW=NYtG%<D4n<gU=EFN*L*U=#9$NiNKu42+WG_|R!vd3vN
zR9qL{sZjn`{l9bCzF&i(7Cx1sKnnOm!Ua@-G8aI>g#oQOzQnq%x2f`gW!6h?OIX0n
zYjsDY_kjp}^A@4wD%OLyYPb}3=4}K6*sv@N`W~_JLWgwKaZ+hQqG4AUMxxiO>cWZO
zUvFutlGsaePV|f$s+%B4`%-7iC(cpvFd%*iw<Brb>@ABC`zz^Fe4Z~PI%nss`9PAl
ziSt6T9rqG8m@-V>37r#apq_Ax&(l0l%3n3OG;dU4l+ZgT-@QW)Den_3ltLmo%$YtV
z=a@EI9xyD%#LB`2;B7Qi)$zx!b}W3u91zWePD{`jR9kv$Kyvbn!5an%dB8{{;c6nM
z;`-jH!&7=rf%qu`pN#e*I>$5#B%LE_S*Jb?HLmCM4Nbsi+D9;eUCZQ~evEA2d-W^6
zw!V0cz%w0G&ZX`i9d&K2P%1heB6N?ad&EVe(xYevC-03%QUPRsj<Z4~c`4X-=>9D9
zpxeTEjrqaUVdU+cWOEO=c>ZAK0T)SSm&R3`1KUto4DL?q;m*l6sI{3Vq7K^HF*vwf
zS#ZwEUfl?4k?>-%1B0VY!`5P-R+@XM<+1=5{m6(kUEH={gz=y;_mxHmq*P~8KgZzn
z)>{Y$%B^Qh43rB?1Ter2`X0;`<EW074j58N?2!f`jphx)Jxg<P6f+fOp?-G6GU7>T
zC}8vIOl=2)UR(WU&M9XT1OSs1wtK^}zH-F5XJuQI@*=74WK9nUsVJ8W?;PY}|Fm;H
z4q_3w6@8DKtU0ujCY2&0R88AD6UPw9jgl<}$W878!L*p3b1t)WQq`xpO1wz;Na@F8
zHvwiV@yz_Db4<%~2N=rnNGazQ<~b*yj0DsJ0t><rZ#HPMY5)V)B-nE<PIJ$-NYUP8
zpP+L@g3FNNT_k^)EjX!fL$_-Q8M19C00v0mGwMfZ9n6o;7&xx>MGonOX(5osAe!N(
zE$2iW)V|DJ!vTZR5toF)xrUan?_Kw6k$bwMA8GZ?fT8A9*8Lf}xLg*4u^%rvk(7`P
z;adk6Fi?({;9#IKT#pK-BXDF~YvX}3d<1D9&Lf*Z>aJh%6Bwoc`%qu;^cTQ!(#cF3
z2sf9n8G+Dkx|R<E*rW~t!ceoNMmQ=v5kXjs2e<rwmV8L-2YR*qqCD#ruV6~Nm6~Co
ze2@|CVQ{k9-8rH;ov^rx>QpD3V_WJo#ZZG`ri0`rhRBdC@W!fC48|_?T_btf*?wK;
z>|OK>7>u1+(u4tQWtD?-p3b*lW6<r+P#kJ4uSdY3*v34zbNbD!e!(Ez;<g+Nc(WBc
zBxp;QT%1eX!rL$g?H1qFLCChc7YvDnlXes51f1-c#~@ep`i0~XjE;DN+>)OT;5dJ}
z8Rmj;N%Yceq<gxppKEol7TY__+(VqJ2g6BVWANY{|4?n=;LWy|Iv2P}I*386Sv`Pb
z>E?4CC|##(l#uFl%UpM^EnDUp1mLHx;2hEjFl_F0j%Z{03`b|@x?-GDZ|TSk2H6(F
z0q1m^T&>0+*xFGNB!tT^!x$(R(?{omw;8YCK%E@=#Ne&LbzTghOQ+qC0=?C1%+4in
zI3|oixAn<t49UA^l%S6)?MhT!@-3~U#z40;QW2L)jHWCbhmf5cnAy#H7;K(-e}oGL
z*D*Th?vjfGEn>}V=*Q6FEvxOE(UZw?47QGI^zP}zm8?Kr1DbOXaAt0?F%<*e(hW@K
zkC7{rz0L)1>8>vb(U!+iFl27rZ-Ieov9}!qp3Peol!6eX{S>p8pq!Iy;i3kH;7#_M
zIVacF%pwNe20DN=pEa|Z7=vQTB|cT&sV*}w_P%=WmiP!`A>)#T5%Fojgt_sc5tpG1
zMIRrHs4oM-=kaNDR=t(GgKNd@?UDguT4pE;w7ky7oP?6K8GO!3HzR3KG@I2=420F~
zsa-9t_Ydbyo390DMM#OyDUn3_p|pj^g*MqkctSaMV|Yd++zI3On^@>e^}Br@62TPZ
zdtW0qeG#QhhnD?7(O2A-WZVn;_(?xLe=hRcdyX$@_THAyt808RFK1D~NWg^%BIOd*
zzw~gE9_}8<RovZYJ=|OPOql2#Wc^k<#aF*yb;Higw662utxU4GPQN8yL&GZlTjF&U
zF#8aA_X&YhnZ);`RRJzPC~CU^%^gxp`?r4v+d{m<Lt2O$U$0rxA^X^%f3aT4w>z(g
z6olKwr-!5>sC^kNsh)~kevZp`FsW<%cf6afpR^?b7-%isSP&@<=7`HFhnfIq>K2VM
z(y-Y?T`^d@NISTJvjxL~O-390yt_ja>N^4gxIjQq83_spi$^2~L%815wb0(;ac6gN
zt1d-Rb-Rr0wgswOUS;ck6sc67Ds!+{9e7kz)-6iNDfNAO8e#;Zi#8hWMBgYOMtVD2
zBqH1vt6Tn5WM?nUz2@&YB-Fans0y5=epO$V=`RGL)-Y&BdUbCz?wM5)80Ky!MZ=J?
zW$T84ZxSXW3Ed>dbB<_I5omjiuW=c_l=1a-YJoA>JTxqT?hCKNVv?R=7(bIR#d$t%
z5|BCvd9SL4L<rhc)v#V@Ce|9xpWN#OaH9<4%<^ZToO5|Id=YeBHn4Zg&Pi)hM8$B<
z!skIKu?9vq8IA+h<fQ?F(Ze7SNxwV497XDL3O2AI6e}o)b0^DvCK&kULM=EVPU0=3
zR`o@7#m-8IEter0beyLqCjCw*c6v#vovX|_snVDHQk-q;gu7F2@^0vyRukI?=Ry`O
z3{nrr%rgT9_2yn?oC}?KT#rG-nf3?(8ZIa87CGGUNjqrme9`m5-AG-jaXFXDdldl+
zllpH7Uh1}{z&}s$40lg+@eRy*j4;a8;l_<Oo<)#A&d00HEzLBpIh93KK^80*n@}+L
zycqS{O5~BlAZWY57p=C%_{Blhg!$^*&m)WO$++B8Yvh=BZ>(KvUc}(BVKnBP%`*Wu
z1_76&8|P+l+b#cuLJ8*wO`Ht|(uq7gm&K*CoUciO)G9nz%64vpEW%t2J<5w*srYMB
zb|b}|lf+^3;uxj#q;-2F+qpO{PGdV~>&o~p2)6kqL+9WYR}^5_lf^L!=el6>ScXxj
z+p@_RoL*^3!T@L<%V6L&DI`00dM0l{&Ot8MoiI4PHgkl5@Dq8VbI)kfZ{^$zO`0X0
zlWlp&3x+7pbYEit+kU=x&fCfRu5(1=TC6Qs_unG94A9YX(D66vJ~<Y0^##6iqLkC#
z_xzasjQWt<<0l<_tPSh;xIEvl%HT*AS3ianNV4A0t1JEj_I5Y$PQ~R(*{%<Megq|m
zU>7msvf4SaGJzJtiPmDk>Wdp9v~9I@E_kcn0*I6&h|mUb%yvYK;B;KHhZqV27gm|+
z2nNhW^}v94NvrCbWLa}m1uX5+i{90r4-d=vfrb@Mg5-xjm63i|;}KK8E(qm2h;wzj
zUW-!w)Jo~{I?3yqe6fAK=yVaQ9kn?hth|7-Wr;FwaGvymubuw^gE!(Vk{4~E&5;fm
z8U|OFmBKmc8fbI!21L0Jct{O?%bE&KIShEqE({VMp5*;x=EOO&6{?|290tC{$jK3F
zr_nj%j7cV<kotuC@`qF4o|()<<o924PL(NI3^|&96Qk<?LMj>OJP6p2XIGkEZ*$pG
z@8Dj6mX^<BL&<-A8c808Oi`avqV;W;Zz8{oBA@s?lo5+438Vf)tlW@|(5F-cgL`~T
z|0eZ$zon(B$c$(_6>ndzWpPc)I#pjb{SD7q5!YWXaru&3ZmJF<PMbr6iVEuI?w1bu
z;71AtQR=t(BM}w~F8k|1lHo3p4WZc`&nZjd@=HT7OG@eb3J(~M0<G6S09h3HgXZm`
zJSXLsuE89IUf1}nuR?#Riz}F9wc`FI&F#CGcE>i)OC)HDpI^SG=h|{Y<tTXrLxo7G
zd83bFFP@6JE-pB@I%`qdd855;eurvcTrntxgJ-0BuHm$5r}E)TlGl}TKVPb(Ol{{i
z4uV;z-;lgL;DUkd#2?L8bS^SWp7Bh@$bdmau6LUcW?Y+4A57vO(bvzxLkMgmMuM1!
z)@qG|Xb^Bi+XcbJ78#~Kf-!N+d1K&Pi-BAt?7StU3&$&^bXw5Z{?8Ru4suU80yc00
zn8ccJ(lyOyl@fwtJ+BE_6<fjQnyIq|ViZuHQcovO5E#A*j8Y3Fe%I19e$#@W)v6D7
zEnTZA69oB|d?p0A0dEnhxBRH&T37FU#mWTc%0M8PW`)c(7ss^&3_OskI4|%JQT9T)
zAA)QP`J8K|j8EzLOPy4vwoCYd;EY8)5=8y!WCajqQP>A0DUFD3YU=Nbh&bVqTnALY
z)oU~oQK)`a776M{BJ`skB+`S_`~Fo(-Dm5Nwnb`pLiNq5oviaP(%=H$j{+rJeW9Wo
zLN&iHi-v+N>Y;6{xI4OGtoWIDY<Gym^b(bVry?s#IB<_5C?;?Ft{oF$|0NiXz0)WX
zlZZ1JDKt<}KF`}2B*LvpqH7}dYNz-##35Vn9RZG|y-Elgv^8mSjjjK{0jUWaAs+<B
z)zAfm!yhF=RDh2+HaLWX9xZ4QY{CLeXpml`U$lc}Y%|dUjd0n(K%lgH_H|qeLZlc3
zriG*o0^4eN00QBvwFA)zcuNeMGp<J|uGwo+_W{8;?`uK8jUqhPs8*`VuA!~JXMmtv
z$$A_bmGJ_GfJ-i=`Y-fbY1m%^A~(Ke?zNSQP|B#k=b~x1U){9uU6Jccb&XGWGs>E4
zUo6)x2tsHOsBh3Lph7HylA(egY=ff2m(iG_bs6W?b5R0~_+?35YZE)>q;p(zOf(TM
zXPktP{RUi`pOYMD)yTZ9aE)q7@^SchPEJJ`Tb&bhBVgDh!$B8k>5C<>-Q%7)V6J1a
zZ#wKa#o1>FCIS}7NO1K}l1DT&2d7tHalr?iq!9_2KiEyR1a2$B*c;cZ$J}U1qmiP%
zAdKi$a(>k3B>7*f&a(H>1623f^m3CD7bP&tB}bHTI*=H#{yp;nD-9$OqF)<Rt~jo1
zoo?&P*x5|P+J^I}L!=rx9<)}Rz7)@2H0^+ZeJJ6B@n8nOOs-jcO3tV&M;6rq0^OqE
zL7-dVEwo~|2KQQ&>EDXHM%LREYYc&JgNCkIe2VjLu_euRk0-~V+{Cw&FN*Yy7w)q#
z3K`*Yt@Zwsvm9}io@PR!Qx;d%m$>@U-mAB$U++HWalikbpMd6E^{JOQ%`f&z@9rCc
z=8!q(;dx%RFetVx`w;k+i07KAr{aR>4rlEJ1hOf?oSU&_(ch{Q2u1=fRQ|3Uocfog
z(Y42!<(@~JUS94#8`-hst-h(K<_^wM(iB2TrH}z(Qu_Us<ZOd@^XuvfiA2A=@=_MJ
zt4*l2dsH(;gb{45vU00RwhI@hkr(GIQoq6j!DQ5bBMLsFX+EbyL}N`$pH(8JOVM-B
zr>|+9G;a?;VU9i_(luK&heTj}&n&edjQk?WAYzGgT3xf)@)Ygys9cLzkBR9eelZvP
zy?xFD7>?IjCKiI1?xDLDRcikb=z^sXZhMt-7+zb7KoZ8dA27jb*pEWRCkz2qe~=io
zJw2<?W#hn%{vB2NH!JQ5pOVlgL_dQ?K}c5&81soiO9~5>MI7V)ZrAa&e<4+adX6t?
zW?||N0X5{`#u||WSZ5<k$^r<YZ*r;lRehsa)Bzf3bFrxden10B7Xhsj=MXFtxrT`Q
zW`!FE8KQ%k1LiuIX)t|@%QUvApE^PX!$iZX5f>rr|8Eh?#5yR~&bdGCEnzy$7{8*>
z-w6>kJ)a_yy18Vr723=O5k(g6i$OU<FLsFY^OvXi^i|hf^7Bk!@c6|~2A=yb_Ie<U
z>pDKY+C3T^2(L`8iOot_htPfo&Vpe?<SQ((>~par!F{3tu>Ty-10L9D)-o~(!XaW>
zmNnPRgpjSt7ll#4NhHEZeO*KcgJC~L`L9)SI~Q|>k+iI8tnK8NTUMu6UC(Mj+cxXb
zVd_uhB0#Es6c%m)q&i9FgMFR(=@sdTe?+JDoQ>@Z-tKH2Qw`!xV@CWTB8e7PGwB3|
z%uLuIpw1G}wHj<&w{6<(Z{oI5uGSFx^;WVDsP|E?XwZH(ag?EUkx}SJG74D~_PG;$
z;^!ukNIwXBKld$9>$&%XwwloVDvl^+N&Zs5j!{9V-YmT!kj)d#H7l=4c~bhNLS;*2
zy9dm-GDB+%A3}0Xpk>xMB-Z4M^zwQt!hlOjgMj(L9?jOxU_*XNW*=b7?{TR!=*u;(
z(<kj(;<5sqBQXH###&6ih$wc7h^f?32Eq@1{2an5u1@iJj-B1Fe6c)hvU{`hJS>P*
zBfVUUvc`KFn!yE96`@ivUj=B5z2a;o%(dgm@QcLnB#)wiMH*T}<)BG=*au_y7Db~#
zseX^d)wh>99lBL@ahdsrIICZ>_pAB&B1S@$1PEnuRAfvdw!Azg;-QQT+8qK#(?Q8&
z0?9;n_s4ZftHw0HsT}?*5WU)}r*a(nMW<OhlYL^lg_0#kL#|R8PNh<Z#Re@im|V#?
zqvItKUW>KR`&4Snu87?MF7Ova__mq6A&0w@FU`NDm5yP&hSTx0E`?O5vdA*)$V*v9
zU7jXB3t1pSwrq`!>B%Ba2BDWSiC$@qEEG{h)K`!o45A=fZuT++#z_=1@d+|+v3qw4
z{^h2$<Q&&AkSScVF|PGvPU1E&?JjIHJj5_}?Xke;Tb6l`ocA{t1ev5v$YG`K@zDcK
z_nA4G4K7Mfl|-pHEey0+$iPCh=FX=n;tLV=RZ%-EEmyJUGw;d!mL}i-xp=eVsU(z#
z%2@c4hEnk525mEtoT#vLQ0`m+`ROfrD!dLu9)wik=43H1FoVm~pA`-Iyhm_j#d|D(
zr?foXvbgjvarssGh%$LjRCI7kJPL-?ob#K-j-8R_Dxg}XD-6tT>#R!kyfpXTUh7L{
z4vvsON+u&hgi2)>u=SGXRcwJIlKXvZw<_^YRplk$tOlF+H<E_Dh0vHKA{rU;-6^>$
zen#}$Sq8WK;g&2O><S0I#kFlQax1PuZUkf)YND06Q{Yn>SC;jx-Pb9^PgRlKYNf~N
z-;(p^oCyX<*NZ8Z8U0g`4?-H3Y3Q1})oXlBlo`y=iG8_<5Eg`lGa*Ps<l2PG)XL1i
zUr0#@Pd%Ea#kZt<&Wi7z-Y;MtbL|gKb5(_1=d@BjuK2D*P{sR+UWr>g{Y7E)xE(ot
zAp}!aTX_RzgM}1Jh}Ex$G8CJLL*)g0e}wp)=m7~dMz>|H@2PTpkId<mrC0Ac&8&O(
z_Q(62{8C)5MXq%E*9NbG_-p)RJ9D@{P#y6oR2QX1$~u0Fv-E6NTK9>H6S?jZ^8*!A
z5E3pMp-DtLhq3!?SQXZ|ytboA&*7s{(Of*8TcuveSUh`;GwdE#z-X$CQJI`>Wu?WD
zp}}ja?WfwZa<@OOvMB0Hp;Scs#<zDbu4{|t^!@R@l<_&$;&yu1hDW&@1<d-v7QlO(
zXN1Q%?k0frUgP|nDTAY+Hy^g`#FoSrIxAG96@j+yk<D|^{JxTA1HzQJ4MIq^!$rEU
zY3<dCQtMlO%8E+oGq<N}T)$ct$PS}m^?rFO%#-Q;ap^*sZou*q^P2nqs7BSWPd*48
zqp=TfOn@k;kzI;&`uy&7%YK#lQ;B{ZmoEuiRC6xWAEJ8zpW-TMD#`jB2b>Z&(M|7G
zP}7!?W;Q(q`-4m_SB0kuv$Z8eqhV(V_0x-v#q_7mhQ{;fyz>50#3DVNbNa*kHMpv}
zEWVn*NCL!)0*%#k^@%?!YZU(!m6S136ajd-dm!!6#{m!qIZfh72y#Ax4a+j=fi!Fi
zK2LBeGnZXK@Kn2&s}ea)Kx1UPhqleiu4lbExk@iri|uRso9PzNFaPp;G!bjwg(_t`
zt~#aC=B|A)w+&=>XYL~<xc9_1@y(~Y1P`djf5cw*9ndOzRC@E8W|k|M_Q(3?|MPGE
z5!Yq<rjo5XDW9!(j~`=mx^1<J@2_$GqGYyyEsNWWqHuv!2lz|nWpUk_$p6*?a4M5e
z46+<m_ttWXL%fID+#7bZMFOlYZojq}r3d>zxvf2{V~}z)=Q6KR?eE90MPnoHO&(y`
z^(H9;AX3idga49N%3RiP>OP0{-{Q-~a^mEGaIV=pte*<gC*3jCgv1tGzz?qTcBNg+
z40}}3|65U9{wY8IcWmp)VM1f)oWJ*fJf~Uay(Vx`dlM2hCwSTmJk1*{V7J^o#(X@%
zPhw2xyw-t7b79tdYIjRq<MSDimeckR=cH3Q^3oo<1b<snLArOlo?|?R-Ej4zyobZu
zsqcFjZ!i)zJ*4mIU(%BoU$2S9KI`KwpbEfMIG)2M+1dv`DIZ+DD=s6sVw+R}<E87v
z*`1T*I;aoeQ1z}a+WDP})9vy(=e&EwsGqV`toYYk()G2%`IhY@!8x;sZ`pwKQ%o+k
zD&vsMrq+XDb#w%#k`^z{(~JIl^4D9OS#SMuP<B?S%blpG&e62t%emMpG|HlX7<51~
zc8y4X$gB21_$8@di!<CKo=JO!b8Z_vi8^=S2Eh=9aBj9qI%oHs`m`<hwsvTDt~Xij
zy(|gF=y_}y+#L^8d~5^wWC!Q|oW55|oAntu1ANOJHW<-bRhKsv@Mxy{k@o~7hY!ki
z8+SeXjk`f0Bf&`^d?9HxScW&+BFiJrO}5BN!N^#L-<tR0GCe0vELL6PeB8I<oSHU$
zy3QXuuVqpt<+sF(D-FqOI`Q!;LI#ft7@lVEiiATyQ{}-R;-CM|zx}uFWl*uLZvFbz
zdW+d%1U<ibdQu#&LS?4b7+4Lq7&vG5QmGt+f{id@uBd2t7JRBDdw;>xHu_mPX?@=i
zDUw}o{dZ0?yHcKWxQjC$5Xj8BhA|X*(cw9#WVc1{qmdM>ZFqgE5QDk8hOD$V$#t)Z
ziVZL6o3hrr4hmROp6Lz80M;db4L%(CTYFA*4sNZF1B$6e8(J{xOeRzH7_>F)NWiFi
zR*IrZJiE=jLnX%`rxw+;dnNc&QPl1GWqNAJiI<{ouLy%MPqX_-Fi5yK?TVo>%N^Aa
zj5T{#!yx72hE(U2+}H$%p(qBECm2BIdJym?>?gfj7{uFdO?OVcnYH=9qCMo#KVe|7
zxP8cPZ@}v@7{Fcwn}y8Ipa0sb&U-f~fut#`^|3Z#fUA*pm8f&_9N#isz11faUK<EN
zlr>la;2h(kTw*YKd%di43fk$9bGQpLQ5fttTbSaUhANEscq;$3_}6jsm~(uKySAMp
zGYHEt@<5AikIrL@?Jf=s?KXV;a4w|VL(9$~8U;WYTwi$nH!9)p-vMAWHsL%|oLL;_
zTm)x(VVt9yeHz421nVYr=VG@#Uk$<U@r@(rphi*7y+`n$nij!7H64Or;m+#zKj-wE
zT`}Pt)%LD`=L$SKKmy`<H<Bm}n{Bq93{4d0mQ*>H#qG69&dE5;n=SiITpY7;PO+7)
zV=$U6z4KwfTzzhF&gIp8mly;zKbhs+5H4&Can9wnyNu4k8SLJ4j&b%R6^42ktW<VR
zzJ*I;7z8wJ`EyQ1o7~g6DO{f@z~TICQ0Sc1o73d$2zMVOUu)!bPQ1k>0XR~(xgydz
z5tmjXIS01Au**5b_B`7qQOq?*#TgGm5y(KWP=sM%j;i;(_<@Q>lrR|$_OZ7uRR47!
zG>ofP?UY}&i3WoCm+D>*?1Gw0(XiP{iFZfY4u}*N&nMn98o26I7Fk<>xjZH3v%Vds
zA3oDeMLJDdUnbXBKPz9$;wiH^v${KWZ3`88uSrZR-S_AHxfziC6$oS_nOX#z-mfaX
z+%n78ll`?l`In~8=G5fK{}Ercq=L!mNY(EhR$wSUR2|e5>3AYfDh22>4;28q@-vVT
z17l;w3vCzEydC!f12`M`U_e{&*v|E1-B7!SXB0Jpv3O#sos-cdtid4S!zq8HrMAyy
zNBESsYh|f*90TTWh{G{{fW~(}#b-~+gY79S=ZT_oonO}^=kQj73Fp{072G+(t=z>q
zzy;lPj!Vbc%Kd$h%d>v5vLIO)(nvp9a2Z7;vW3P45693*AZdU2HCI;o&e2OzUSF*q
z>vzX@DvI)4DXQrV>RaO7@>FT>N4A1QO3md@WTS`RnwLH!rv}7g47?jEg8_0u7%{*#
zl(X%C_5IKfxF7+ck<TbyXyKeg_4w$4s{5=jhiQ4bWpUY^MtC%{TW@gL9je}*;r*x+
znY*JMH{SoI-H*GYJ*#v-F3b4+zsmF_MM7pIpw3Zt;67K`K0+4nF>H~&zZAKB80(PF
z42_(lUdlGZ2g7(bKX<|W+@iSMVYZz)k9IaaEB=;N_1rxn48-?6d~F5XuK#m)a4*V&
zSEo4ZE&sp7mF39h5uW^(>mr$6jD%!^9(EE{r#pC$AXkqygT)eqib)gu{1n(Qc)aWe
zEf#WPh2j{5ZT3G_mGUrN^8BpBaNVf<8lQ{rN}Up<oa`Z_Ps&i9;Ox+X`NjbE5sB-4
zGk9U{ppJ639z)zeg2>*luU?g8T_HY;btC%6GDsYt-Ew&AlN9?SdoJUKc5#NOA&a>_
z2E68R|NdT@=BMn|EN&Se18~mf#bD7nvQd8eiA5T_L%atG_T#1p@^z+N9|od%Z4m?V
zvQc!dE)Rx(B+X#N+XxykK&}T~7#OGN-)C<69YxB!k;IE)=PD7PEMFX(wQY8D_J-h`
z+nZHI=LnZGX6Mj!-JweAfBHzF+Sb~i2Ox%W7(8L20sX|Zrvoxtw^KUzei(eVdAV{<
z(zQn`400OPy)mGgmdG&BJ~X~P?DDg~bFMSy4+dzITr}+%Kxb<|&e^@$FyS2GYy%+%
zOATwb7+^=7#%|0rd-KO2tVya3M9_s25CTGD`2=CSN$;L>x~@KpI7hemo{7QY^`1xP
z)H5nb0->C~G&l#hxr(fQt5;W%4gMz=@l95d^*-w1Yd`zHhu=dKCDae^2R_%U&nWF*
zVu{wjhK0WR{lQ>NgE2uu5wIQ^UemWUdHkG@jR$2}lrx|E#IlggNEi|+L`eNel8E(x
z1isG6`5%D<>Zk2bnhYRq$khR8d~-BZsQ;b|5kvvi|FR%NETB|<J@12geDna*eYON<
zU7!yJV<I~HBO*T97Cqk=KpWqDB9YMema`F5fs#ItA{GWDjH14_e{vltjlv;;;4Xjr
zzD4Wo0TN^}w{$FRK-kq+F%U?;c^-3wiuq6yB;eRZY)8h9h2)55lW$@);9M{su!#Dh
z40_)qJ`?&$$>kvQ(~GRDxtLk+wbtpbWhLW?V0DV@9})CFB4`UlaC7s%&7QfP&`iFG
z1j;pXW#%a1oKpV7ZBO^)J!^eX)d@s`oh$fMT6{tSWnrldmCPt-`on+f=8)~Iu$U)&
z2e3xEX3YW^5XlYT;yyoe9{0iKo`}UJ_hEV;O^AdBEbR=Tg$D!@Vl^(pgA_nXHqxZO
zeR=0tNB{%^X;7Vf6Ah@8J|jw0)fd`b{+fncOh2~<VlYQs$6oz@P3B8HaJN@&^1dU`
zAZ>rQFI(&cY5Gk85k%{Yj6@g(gDT~ZxnNf&`8g?dtJ<YFC)unpL%kq@1*v#Z58$H~
zKn)JONQu-WYVW;{a_YXaf>MOOw!nn?5&z+$s{0~;W7YIvUyh>U%zXX2&uI|o6~R7N
z92LP*F|6k+*WG9P*&-Yh5*>o+2};YE?a|P~)O`1-=UNu0q^f?>um?uvp$G&L_DsJ?
zsQ)oaBK3Wdhysgb!SH9lCgt<21pgz++JFRi^T{gEH~<aO2n%F2&Z2mF0Gj`&y?5<y
z9JkVi|I7J2@*-}$d`vo*nK{XuUa6kseDk6u+Ga|(m!#~ftabkT0Z2*$NB|^N7Wp{o
zsu^_}Rc$=l8`#+QJvDi7UI!rnfk51q4xRxJXlfAo-_GF;(vaVhQxwyP3(8_9A{GS`
zY~!(`)Lv7&yIWPg4(T5#&+GCkktK;Tjv}du#$h7$x@m5Wi97K)7D8<(7!#D!4=1o{
zZ}4>ZW;-NBR%XRp_M1|X|F5c)_eXWsUtNXE6A0E-C<3m2zBq4pKWBx!Rq_T0Nhoiz
zwDLZ_z`UtQb=;PT3ETfhXW~D+bV5P4{B@q~?r3iIbDjFHPr&V5VgXh1MqI?topvIk
zIShm+36+YauAYPg4lHZBdLUvmUH$Lur`4Cg{c%Meh~+?>8vti&b~H;?<NF5Ch$Tr7
z5~=X8P{d59(2dn8Ea5~$?!h)HEBNjJm2O@(({Tya;dwKtU5A!MR9P3Xj^ny?#nG;r
z9X?L$s%@P?f~kaxgdkibTx#QqJnP8>Iz>`XB?&css7WY967}*RYCe`LX$6m^loXap
zELp)4K~;D%NZh15<M2Xj*9;cs`%3F56+{!Rz}*SwJYY)$Q}uU>YUwHvaL3KhQwWIW
zjljdF9lU_8o^cM|bH1&zqHG2QucZC}gsm0B&qey8s5X_Sgeql&1rd!SVYm;5;<7e)
zoX{u^^;hCpy9gxhREwZhkgO(#s6#b(IAT#kh=>JoxHq)0nipRfk%$M}aptBdB6sJj
zp@&e81kL2Bd?UtZLEN349%vB9&2t?VCS5ziUHSV|_g^JU#)Dhz?Oz&~`KHE5(EJRA
zc=20^we#SX*X!Q+c3G9yZ$tJi-5s}?di&96sJ~!{YO&*eg+MpJ-=%M`M`2$YnnyiZ
z+Pd}_{t$=GX<tL2^E_w}_zZhzI{EHx?|AM71o=FdV`-7%e8`pt<~Fg1klp*Vc`obH
zQrPD+fw&27L9#SgJzDY7SHYu^EPddd-b19*W{Z|A%~M?;nQTB15wbevUW5UW7^c-_
zkE-lAJJ#E7{L@9rj2PSdG0BWjm?ECUED1sy1%$-zRzf}BjtyVC)|V)!eO{GH*i9%~
zx;yR84@H&VWMAJOpmBAl+Y>XKKGW$LW1YQvFvTWYAEw=k`xhAXB6gFli5bpbouOOL
zm{#PQFks>C&`d35io$+>Y=#v^rZ`USkFCBB^+zz}rq0b!z{_B8l~1u<RmC1t%2UFn
zP9!4X5+?mxV7oAhIi*2hdBxU;{oAw%@!apjq`1z^Or=u-Vza&clBb&+q7!r6*zKWM
z9gD;92E}QHr(X-&Vd<R4p_^p<&-6Z|+x%s(lucNwF)VH5eAG@w4tZ4#+J#f>|M@Ji
z^<j5Zum40veNK&OatQnWFTaKk-!=>ZUx}J_?<Jajqdi`LP6_?a9?HDRI!`PH%GP{6
zPjCj~u<Pb74(#HYkX+s>+Zst4YxiPucyo4JhXcwxr@wu1)|$2$mfNJY#a@cT>DUn@
z7$;9R#we8iZ+gQfr*zE5+s$EjgN8RV{bH;uYecaDqj#p=1E?U^bD&d6!e%@$nCa6C
zequ?Mvlgm4K-3e{5rebl^##;fO!<uEjXI0w?73^8VbIRy8(2IbP*&f!>f)};5>10Q
z&Rc}#i}KtBpaa*sXF=bJ#%i3BH#Xl(u~nO*1;{+kS&Tzxrrlw^5b{1qbSw35<uP4n
zkUD@NjXBie(*??8cg3>4C=7(|DDC3BHRFs^ssm?a>^c1j(K%a6$~CD^NH47!2nF+#
zt&99vtzOgpM&(liCwqiwPWNm6IIxebZ-^~Uxoa#+c|gJLs_t#aGIb1{1Tc8ldHDft
zG2L&Bl`3PTqhRGe=@$as85U#RSpA8>y$)@m!e`PpG3aMj$zW*!gg|@0PHiSdw%z8(
z60=spmDrAfu9FBgCDC}k0<HQVkjym-QLr3PX59j=QGtbQAn6n1)Oj)&7AK(Lb^^Sy
zzDy_tfp^W80Zi96RjDcAyBTPAzPg9!=Q8U$$1vz;1}p#>tYtA`DSDa~g`UpCu=IfQ
zwb<n4af=#=YS>$3&uD%!(>06bVC?AblVeab$mB~JS?!Dhl*ryxd<=-^3;f)K%dqZ;
z?rX$C<}2^TVC<#B2kXHw^Pnd8Ltlz+K-d~R1uOvS^i*IF&eNL$1E4PH0K-zIX@-^W
zVPxZ@2UkLL`+`n#_}sl;P%BuZ<%k)+@Tj1RUyQSA*WTL6`Z1OKjRKw|EDlMWB;v;r
z(j*RDCocx{Sab_j(4xwnLX{~4T;`T5fZX+T!CRbodJqH4F<|OaSh~RFzOGM2dFYl#
zEe@}J&DMFb-ohn+ntTO(YmMA3tkfg_xkDjettX$#iNTeb%-ZL}zM7b2Iai;Qwom}o
z$<x9E)lHg2#woM37LAlGj!l2~0UZ@)b;XqFZL=k%T!$~AsdT>Hw~NE;6fsQ6UARBE
zU0T+mV|6<qOSVie514mWSDXODWS(R)41k@-3{W?|#^IlzYYh*}@EPb?u{b_GKOfLh
z;r4<qPC4DGz*3|<?x)4Enei0BpoP=@gaOast-#WwOs6*1ZS_AB7`*K`$pE9tp1$)K
z0K0`NfH&AIz5oPhifAlD*Jr9>P|vj21eCI;r6GS7J8f}jmr&WMc)}EUdSwWpIB~l5
z7H6%e&k+Xc%)k_uB<|#af)%Zp{d)oP$~@Vii?dcswgfcLJo?k(lrw#ySk_tR!cM*u
zGu&EFKHjLaclV?``|t>id*Sp)VZdtxw$;n_do!UKZnVlkYr(}YuxB701_9mUBQcJk
zGu0f6wFEE@<g7=+fM*)rSO%o2696hy9$guWcrl=f=80!u5l;XT&(j(l1EAR!l;Sym
zF6o!qTh?X~B3)l!DfRMBf^LliR%-@7YcY<WskZ=LV9%84#To2tWQsvOX9vRNX;<e=
zf6WTGF@NTjz)}c&0p`WQIWxL3?t;4p0}J1=$T0m=&K_KgpS(txw2mn(XwE8(#gX+=
z&LQutGm`-WptE5k2E4OO$@i~Wk>Aq$Z3Zpg^!)&qDw#ScU>gMgRbE`u^r}a&M6~JO
z!|EF9wQw;GpQphJ20&+xCW!p=l~!X=(33*7_zm%R_!h_JG;%T6>haAlPCDOQA`I%e
zn>Q^^JYVyA5TWPFWJTevYu3)<yft$k0i{YOO(}xCx&3w$81S5v#TGw%-r|hq(YeMu
zVX)OSGXQ-Vp8g0J06kMr7C(F)sfXxiF_SX^UtRNtU^xlg6M+F~M*w|P9_C^I)SnM5
zPraus7lU-B2Nz3UHl-dQ@qBIUF%Wjl$tnHoX6|zaNIc`=0JJvrs4ifBoabFzT(tO`
z*aFgzBfF_4Wj@YVfoPlQ1)|XVo5o?BKhKa^41m4hBw&KSk>4`q4$oewi{%lzylu~r
zh5x$dg50wZFfqtX$pDmlCO|})(wZGF=?S#AqIZG;21NhkvG_GU2iZ<V4oN=U_5joV
zJl^`n+3ITVusAShFUrM{b<zm{?}F*40yA_?2T%-X3)R<QldTW8JY{!pJK>oYv^aB(
zJQl2T=bE~Vcw;9g+05-b3!qqQxJ9wTEqWjb&|zyHJK$hT2<YuOTRn&8=Q8WoLo80d
z)@VHK^QwC*Fv#cYCcilKy4gus2_j~84dB)A<?Ufnk3v>jxte$`PCH-Yt|3GF?k%Sb
z7X_AL><OJ=oH<XWItIXw)s6ModRjeVP|wqM3X6CQop^|?f%V`IdbV;5*cist2tF6U
z#jmd~__H`T-Tp=ni(+{#+B(Q%+D(I79GRH{5@KBhXJ!S6Ut4p5Vrc-rDXAC&xR;&>
znBM3~69C}wwGIsnnWx+C;@F&2!#HsMUK}78J&o>{&kXSQ)B(WPxIrbGivyY~%G2f<
z<LH^)Bme<k?r&QM4q0jFIf58eyms!~9S>z*byGqXzbKm8ho#KxZi^}1fags<0(1v-
zvl#(pizlgeaqgN%B%nw!0vUkJZC<t_dj>{Vr!)c<ru*U;7zj1`VWn{CQW?vL^hlJ&
zv3bJXi(}JN6TmcD-&8{o?br;hKwgR_85HZ>_1t+_eF#0HJ~3{F2@p%(IYT}eq;ua2
z418v$0H6Y8rV9W9G&3&&-!=2mK=1EE(J4p)DcFgqVWqEn+D<Nx&Gae@yeOaf^a4g)
zoQ3j>^VZ0##kvyas|)CoGGARlfKF#J20YJ1p2ZKJub_2taOTaxa!9qYspDa*m<#9m
z@x#No7w72NCNGa$^f}uUjK8kp!o`s}69_R5ovGwu<%POqKZ`?ik4D2_tGf;u1K(NJ
zZPlibU8Fi@BP5UYNJ}(D9&^USScFk1SS;c=9N(EiD@nUxqX{J}N`l_~*ktAUmMW3E
z!!x_9O{$N(JGRy(P-B~#FEA5do9dtGVr5o%(;dophj)H#)j!cV+i6Av$Xp-7#mQ$n
z1tv9<<TMN^Az{FSM95de5gD}<1KY7RYffyF@5S5zr$4pxa`y&ZV7d1e>|#vLAiV$K
z^S!qi%&kqxTXVaYdvg~*dS@de`<CvGlPl$y)1?+i=Fw9y&YVXcFHXFUnu2@gCVB8?
zMK(Q(yrjj50kHb69NbT7nXiBMmp>!RI$VFisW*KOLq$2u<4fhwRBzdAFNO`_;)k!J
z;Q?M=k1G!YppS%$^H-ll4k%na7SQ6Z0bMRn3jQptykl@yr{45|yfbT}!Q}qZ^Ad1+
zg7VBa7fk5+^gRsnIhDS}iRZkyiz73;BVs)kKFb#G#7)oeSu#j~VQBbXjK!~p%MH3X
zFwdREV5=tpw75`l`h6B>tJ5j4IL({}&*C&YYwefv-wF3L2;v~*f`o)70i)DKHVe4x
z(iL30X6qI4&%@!S2jcDs&*XdBX8T*l-QORfRuK<~&WsC8cO%aXa8kHzW^9uRsOLF$
z<uP3=CnK0xG3hqldAB5EF#vkFiviHXVzA>kNrhVUJzE@{PaRksoadpyxDqZ!U?Iwx
zJCO$xg>ewaiIDrnjBC3@{#{rcP%6S$--SsnH(|7Ej9$OzH4b*#R{8ohE!x_ENlarT
zj!7g$OoJpM3Dd`d@LN!mkj639!*niq16;d5vaeaOSJEFC5e5ryoo+2b5iSxgjlV>V
zo|ynFl9nDxr~!;7p%6)A7YI}IT4_~EQY9n^>&rT&Ou~js(w~zk9)W8NJLdss<K`%I
z^RV>Xwsmr!ZyFF11zd{GI3#hBhzaC#l)%s=?ma>+`LJqroyah1hkV1UfDl@yF$1A%
z**lqd^WKXosiiX^LmaaG1LNH0J#Ley8qLL2YkO~y19x-l@tFX=-;}!a@7_rScQ_At
z)&GxlEuQ!F0&M2+-tAfg#M2%&43aeu{-h!o!orx;&=L|crUy|6LY4LrsUnJK;C>kB
zgpB1`wWR5VxbslXrj0<*?dP<5{q5nj-;}>SjrS+b#nZmb#Q<irWuTBvz6VQbZV(dJ
zaS4Fvc0*VFf8PwVADZJZ54ugZK0uNUws6|TR1C6N_z6cgz&g>JQ}g1OChAq-QIe2k
zDl#s3+(kyhs24c8xk_ptc(93OVA1YRlsbc#xz*iCo<ynwd{TR%QtL4crf@*vvBqpE
z4Mof~8a$;{{?(E#;7B4+%YWG`74D0qTUJhEX(%{j2~U)UDe33bFZ<cY)~Fz70T+yP
zINHFYqj|XuC@^xd&wvbvk=?_Ofb5SdI`o$!&-RtP(}(?k9*X>*@=Z;*h)$Z{?ANb{
zV&buz$3Xp4`u%X4s)Wo!v@tA(a9;jg9FAF0<ykpi4$s5fKV)fjDyBYMGt3Cv9`-N4
zTm%f_>HAsD&6THa0!wEUC1Ae6o_t&U^ncrJ>t_p$d%u5vmS`qwMl&7wpMLk7Uw#8d
zukPyv0qS?z`cR~Z!l8G(AW$_-ggo?JX^P{QZ;&A=6n&A3!$+$MhNEO#lnEf(bp$^S
zGOM7)f!C93i%VOVTD>?ht3<=OpM5)NsI|cTO{8i%ALnU!aEr}053=hk02aiv0mBHB
zy(w7hbbG5Yet*XL5JKFCFV*+$loK~gq^AoCCkA!ag+2#1kkD8VGkKgNc>-Cas?78f
zGcoWCT1(7m7_nF{F>5QtEm5%MPyU*{NWx4#Q8Uf2>VaFxSnBV@3FC>}iASo0l+X_+
zKs_GI#x~VCO!?0Ll<)GXjj-;o-8j%KrFL1il1i+!@xv%4RPaFl)q8Cf$2?Gv3yBgM
zvVea0)n1pj^PwivJsrNS<OZwvd;?`Jc(5&L{#nY*X-vYTPBb7?xr9ER6lqZ%9`>0n
zKjG<ARg)jmyQ`Gz!|v&zxQC;IcL}vPpgxT-c=w*~H-~q$l(a6Y#Z&mob#d5kpVEn*
z<3)fiPAsKZPZ9@rSM{4(BdIZN^Af4oP>)g=mXU*8AmFyS8i)Xn3dM}1@`p>kS(+rV
z)M{DC$J-<J7etz+QP4Gf=tD>;lj>I#$3YSaJwlckyTm-<JkqryYa*v0^3`Lef=C~T
zEoGB%6`)(K1rw_$H8l9!W)%dhr`3d(Ml|9yph=j75`V;W>(K1y5{rb!bP&G8Bmy0N
zMMMxwj5Mkf!Kd{;p97x!`K$Hew6B}SO=>?q1G*pyge0DzV)eYO8v8)9c)gn1BWeah
zUQVOr@XPZzHM2z_O#z_>iszE5tTnmnb~#YD#$^1iQ00iI)Eps(K%kmbU2h9mqF#`O
z=tw&PG?`ou!U92Qz-dGish11l(8_JjCmY0wNQ{Z0l}n9-DPl^X^-U_&g<m6GcOMal
z6smdXr*1eWWc609&e90@rL+r7Ae8QF4FK|dT|~=j<FbH=9Y06_A`U+_%Yz)FvjLzS
zQrA$9<OpSbd1?+lh9JcB*<~OQho40dpk5Ok1f$e>>UVLy+T`VNn|@cM9ADEAg)HK6
z7|S0KM^X=(0MOo-mNQD?DF7?IuC@<QB$9HJC4vTth=au8_R`RJ0k&&X0FGhw{mIxp
zi<4S~3PwUMggk~+{fj$HP35`cI=btU9;U9>eCVb$_?;h}LA!zTw=nHSRU0e|ad84#
z^#?LZf4~5V$?WOfyda3V{ITRp6N|{|`F*oGrbStI)nHS`t;-*(y3lhP#WW<wgaSJ7
ztk_dW809>%YPG!4!?q0_QzVQe3PL4vHicAd_s`pPwR&H%WVL|;c`*sOGzp8W(P*do
z9p?ZVw0DQEE~eHLC;ps=@@i_a30{h&j${~P9Z3rr@$Po#+8oOk<b(q$?W~XoJc=Sl
z<1lifyyl|#QN}z7%sDPrb|(=WyX%WhB+x=4E#7bGNIMHoULVVFl^@g1e$_VWf;yKS
zH)O2{1(M%@@?3NHtjP4v?=#R+71u~fM9Jz{W~WuYX)Np<59#%2o=;`~cQOSbEj811
zmA|dFdsuQxs28?xR@;34RbBO|<>52mp=rI(7t%GP_J;QOoOO--tZamk3h=rt$>Z~(
zcu$MX<NB~Wrd9s5%^uGd8W>z<MiTiJrB!j-W)nwe&4i9gk)AbvA$%=eFtD3rP%xPq
zQd(9zf*`bbF~AJQn#*+cHT(X4C^qH9?yB?hxLlDK%S&aw$T0=G$hFD930D@w>N#&M
z1|WpWQdSBsXRG44T|GU0Lp5rwnj@PK*IepQCWc!QgqmHCKA!C1t0F72R)aX;5zy-H
zLu9q~66WWpkaqO&<vHF-Iy`N0y(`192Na~VrfC?i>Kd%F+D;9E&S%WzyW^p_X?nnn
zKA@y^Pg-se2vqCg3?L7u#m#?9Uj7`ue%=6;ABXLsPCrfI=y~z=v&Pr|^xj;iPjW`%
z2=I)aX-b2ZrkJd^J2gNF+DOu<@uv6Vk2pXZ&Xb1owZxxbYlJ-Ep{mLy2_^1ELF4cd
zLAYET_5ee&T;;r!-}hDetuv<+1fYCC$SQp*SI0xST0g1D=1{hfHM5Dqsc{lz{Ytht
zSH(@0i*q0)b?mWxP4}A{a#NR*=aIm?+?uDFA$qE9wB(SqG@OO+MS4_^Bcuf!DCZI9
zD$cArkJK<fi!nqXd4E>kd8=;pm3IKK)O{#JKwI7Jf@O$2Z)9gyuG3>yVp8+`s-LCO
zb`L9)ta2VKBUrO1^G|0`hM(aQp~W#&izcNN%g6F9-8PfZ)mxd5Mi~epSQI2l!XrwB
z*T2=BjOXxgQ5pop`X*TFvfb^DcqaSl^l(qPVU+Vv5ZMn986BvIz*;Jld6T{|HH-1y
zP9kOJDx)l<t7BHIvwekIf@1Xv6G*0Cl5JlPZ&_hWwq5=bX(6j~#7dQ!K?xzd+ZvMR
zmih#WmIZE?o8l9^;uMkRW)a0_NC0P_FaaC@rS8HcVCl+@^}r>p*MByywodU0%4NCO
zIq_<nrJH=;Wbfc1wRtqqax#alZvc>@eiAubRo|-BM$OzqP1vfbxt1b4-@mR-`%PAC
z^ZgASU1olC$`t{NME3mtLC5b80MY9HMN12BOo+{4*P0M@j%$vW<l6PFP437wXXqqp
zYn(flH~_oP2*cLvyY6^>mxpNaQ!0d5cY914CIrgH``6aoPwMWvkOD*j?Jvu{rg$E<
zGf2{2?dl!wZrjW-0())r2>9f-XY=U2ikk9v*QrC#=`P=Xhri@?i6#`kiOK<8*WH^H
z9m{|AJZi%XCsY`t{hTP}Hh~z<{AQtuS>$vAP3k2+$E;^f`dow$;++{vro|BDMk-qj
z=Lc#yEgA}<GTK|x3<A;~b^yy1vB$&ELh`!TZ@+r2ChOy~N=cXbg>o+2YCYCe>s8;6
z*+ji!25q-Cz(~*<V7+KEz?oE)!>W8VKdRm+1XPY|MOt9V=Utx<qHQ=r@Qgt^hx8ed
zgABlPHTz>N1>{DuJ=<^6rX>J+y%PruczT;EfLxu6H-NR?fG5O;c19`0^r0F{DQFQ`
zkj~cnfk6h4Erp?owSx8r-qVrZT~iaJF0Q9+^_&+{o80F6soLaH8B1u<_`aix+;D~N
z-=$!LWCyuLrdMt9JfgXjV3pe|S%28=vVDbDThLY1r%VH$SEA?FT7Sso<DoWfATTYG
zNagfS(A;JbLW5j~IGeqY7+gNDO?kuYpW7*fK#PA`bvCe~7h9)(NDu#T6a3|gNotPs
zdWQBo-M^)%sY`=-U;wlX8%LXz=ljjIf@orx)~sQ4+dJ|*s7ZN)_KphZx|8)eAg^uh
z&KPF9GbzpMr$^Fpy-mxq$^3(h*Pb<vxYabCfPEWh*`8m7JJ=&RqMhmTAgwKcA=9|6
zS;%P7+cw@Pns}pX>Vf7U^5kToaN2NXAZl!+u6__atP3^LZGO{e<$1G&@^hNdXONQS
zy#^tsz0MLW>}b=8DBh$uTV4iaXwMuA16H!?X%)9TxDmq}QJ8#9i_gz_@n}-gEMh~P
zKWEPYL`x?y=okpB`)n^kN4zrjTuQW1z1apIQ9-kZYd;UiLqMb#aUQoR{E&Twu6dvK
zv`-LX+NC-o+dHBiae$iLf<Ppu(aekhW)0bMK+*DCtO;!#liw@|p*e1IPERgxo4q+k
zR^(N>UuPYs>hfpPGg1_Uj3e@sL6F)a&0ucdjsY2d7Jd^%e)qa|L)zoLC^Pv4uVeB_
zYGXKPdw%c91m$^%$aBj`6EN?uZ4{wWGQjczbviyBicMBDL+RicZb@KdXbFsV4<X|H
z=_ni#*4tCtI}%?=Rz<d5ZL_I`w}jIq7I8wuL~SX!8)HZkMn+&{QN)IQgOI$o`UVm6
zz3U<#$#=@nMLbp2?I#5S)$VyiB&yx5^=XhsXen6(jfPNY=@IZC5DhP;z{*bd8RP)y
ztZz?<bx~Ab3VAu+@-lzQw|VuwqgXDFaJah%$W4)UBdrs~m}9;Q2+mGE4rErkJ8ypZ
z18KJ(z;f7z3fGrMIA#XbnBzFZAS$yLKUj{Kt#{9-(Zxfs+@|3IYZPjFlGy;r*zXGn
z+1hM)C?^mt9Sw&UZ-Jybo3%bku;|E;{~6>M4z-F0fq6}f4_8kwbzKf>;{;pZu<5N`
zXL6xNTFMBN6d&P}S{|frJULjJ$lzS^<snK&b9J|wR4USPttKVCfU1!fDI`VtOTJ5A
zGQ3KIPQyLO5!z<aYPw&)_U1*RK<y8W1hZv_$6A7rvXkHomS8nxHY|^Dus9iq&ljZ}
z%%9s7{&KcbgMYK4KdlRdgtoChpp6{Dx-AB=SLrOzam$<qMEj;UB>?hbhs}ILvQi*d
z<#Ae@T*4Vw<4IU7!cZFXo|ZQ(P6o@8<xdEMWOR?*<&R=57mLH80<#bXn|T7%oA<(7
z0cLp1QsaQxZ`778ConxK@|uTA@1d*r*SyNEat9CUMTv}>*QSKifNU-cg4V3gtZhla
zD0tQ=f;Q&$8O8#{XgN}ro~Ru2P7n7wfgoqEFX}DRKjwrgRyERI$G_#N*>$1CaLn!n
z-O)-LIux8}%}^1H8)6to(v%o%j!6X%LQV&TBmv8hvv=u*uI<(Q6`wXf2f+Al1~FRP
z>&))3aXH`80e8U?WVCd-Yc0$1^?P|OX89D<jL@>EEVbO7Tvz~*O}mD*R4Uhp?V*4*
zXwNP`Do<slJm%%`hFLG7lPKx){Do|c(Gv!wn+T-!9E}h!PteFr%HdsDXH(*ANvMI5
zpG3B!Wr6k5FF*rM_Pla5wWBlL2hA=U6zTvNyKT#q>k2B$eR;om8?XZ$2P>L1AgN-!
z6o=ChH($vpWkF0oZC*vrR>g6<%Aal(kav$jt;>=;J|BwrwAehZ54&Sp<xkt}@obeN
zold=IG6ZxM5K+q@HHWbdI9A`cfO8o8v2MJm=x{YO2+M8m{;q#|d7hhLrwFjeiD~9Q
z)&}*n38qYuQ~4pIJilt%kr=)-EEF+|hFwC4m!_4I@^MsCDmK~rP#_K#vwG4Y>1nOF
zLhO5B4LMF%FlU&k+?mxzI<wkP=xOs}-QcmFq1@MgNWr4__HtU#o1~YjBK8}wg>&H?
z)^`68BF8QM%K$IK!0Nk1B&R)_NFX9LbYrlh^bwuomj~%-H37n7O;+Yw!wJ0Lgs;!d
z@{G2(rbE2cy=*biIH~D6;8+=}ox(fFiHyT15`d0+8|h5dDYx!wD3HTb4pDe+9?K9+
zM)n<9s;qYEQ?rm4I0nngvAe1n;HeCfK-Fn&^76P%zpvJ>>Hein_)hUW8|J%109Cdz
zL*79{DID^A_RIYz2Bv0I)7zrk3UHo^)ol&Q@T9Fb5-JzC%^g!W2u};{O|L-ox7j_c
z1d;Qde5X%CO@fw%XZ2SjvfTa-f#u=Zoxz`moB<-zOI2x`whkBq=n8i<gU!}n0foDR
zB_7MuuUB+L;ZhCyW4wYJQqyN?SJ4HES`B9@9PZX(FVFa{A|w#)TzRY%Ex9T@+8)+l
z-}||&%Ttnwn&0x3sl8gy=`P=X$4p+n98J=={`*CS%ahZz&331AttJ%DySE3dR{Rnw
zQ_Zj7UPV%u3#+QF`og@W-Dy+HL+r#F5!3u_MIEpMN*vkqAdKz~2!IsbHkTEJbXnPZ
zECgVTw>0YlRVYVfHUZGHW9n@8ofZoq#JupGH7XEpH@W_>1IR1`qaN-vq=+%J6tVtj
zCx#^}Ew(p<Gs84}D8DE~ka=vXQg|)j@w!v{VU=xn`wDdavqh*=u-jwnJv6-?@!jh>
z22bbmq_l^0z!JtRJ>}ut`Zm)H(x$MKkb)+Ij%irCJmc+gaIm~F%MC(n261gLpPxI-
zBfjL_mW%@Pj`yMwpiQYQX;`4rC=j*JNUZW^t^nTAJZo-ehtZjsfV4b|qp%T2Yfyp?
z<==teG)uO?-0Jp3da%r<dUl$mAv+IXNpEPkyI3AD?c@QYgzv4zC}>GoW@U4X*yv|y
z+7cQS0o%HFhZljF;hjl-+kF2OZUm++dICC3%bZ_?HtgMq>OF1OUt!x>4hK#E$k}bh
zNC8E7n>(^j%dAsgv^)WOy;Zw@eiRyt=9N)7BzaLv^QNls)ZGz*a1?r;t(&;DZs1<U
zUaB;hUeWahC0Otbp#yeJRF=79XSqHc@g!nxwyafijQ#8CwBKaKwy9Ca)W@zJdJub!
z*ejdBGFeOy3hJzH#b0S7JRjDlvQ4%@ob_!lzCz2u7;HYhJVtx9KUi?~nkd3oZ|PPw
zm*KSnnIoaJ8Lt%5cr{-}v=cd;6$C;?ZM<ZDo-c`}-qJeTPhRaxwVl`>_8DkOke<v<
zu=3PwgIEK=(nTWbWCrE*QMST6?ud7N;uB;9WU!??a{L1>m#!N$E_y*@0FYPZH(gix
zn@#y$9;KNU4Vkz-+;L!eGS+@R6%Ao$KVQDTsc-k}VK2maY4Ud0s;_(?*W0u#vvQ&%
z<L+6qx^f`^{iOC3S+p>A?XnWm%2q=T(rx~N*BPM`YDaVCT8-@(vz)1yYK&HlJUl%V
zg_uU?zYx&+@?>{`AheZ?5VZ1ryH^tNe%n3fkVv}$x&-ia+7t9cKyr3kID8rlB19x+
zN85mG=ir@B4+6682bS-S+dSJ~K0hNWeo>Hyjq^NO<@-kAn37IKs4xd7xs5RiKT1Xz
zV`}`{u*(XOl$XMhxUFM*YFyJ;9{%B;;wa=Ct{qvPoaSH^3aG31=4{~2g;p&T<;@BC
z>Qv-SObpK|vzHDaUL0TMI|{^0$w;_*dQqx6YK@(}RtS>q{UFrjmNJAht_HQTScIW`
zj6Kgei<7|!l>7;yR1JEUT?(X-u8vu;zG@s;V%?~$BuLI_yHk)N9!Pfv8vut5CmUjl
zgI)5VWhq)+Scs?5WVpae@3kuzX!(iWvX<rX*`1V#XR+s`M05q2UKYdwL}OZ5fgZ~Q
z(XZxhCk%qom*22FuSd9mQ0O>3{dakCj>vOBCMSbL+Nlr&8(<qGO}V1fA@iqiO3{EV
zMYemUA$e{j@FSLFT`Flq`IxJ>e4mw{<S8d;>9dx)lJ4LS6t4H{1%q1}$INnrRQ6C9
zuC}>6m}RwXauxxhS{nHhbCwRk866?zmq%%LZlL8RpYz(1wyLPW>|AE+62;-B#cIv}
z@^kk;HX$I65<LL`Y4uZs<tW>dLczL_nr;|GZ<ejMC+ZA~ju3*pI9=x;nvcUbvTb>I
zZ3*jn%Dbh6b$N_KeQrQ*OWlH!U7EnH*4q-b!9!<K7G$2PVT2=Q5ZII-(6o#ZO`4a#
z<~EgAU^Yhe4kQPlWWS>a1?=cyCd-3WlUXJ?A*P1era^%A^c>OCetEW=CEy`oHLErt
zz42gRDnqsjKZtETI<02ms^0Wgc3F{E>3*GoQqtNu6Rg{eJqi_L`B}U{M-Xn;j+P=T
zv#M!de}E#OHNFg%3}`F5WmphL6bk}?6txPZx{avYQdZx$pxs7n<4Ex4pfzfFGerZh
z1%)*|3@j1Hrs@LP+x=F6951NYE4U<pt{^jaAIy@qXU5~DVVt`?o|`=a&I2{wreLD6
zt`(BUFqDM*w%TU<iN(pBCb5VU8YXH(!QBWYm?Rp3kcA=~Sw*ru`Rqjnc<Br0Y^8Iu
zQa1%?d61o?W3UMEh)H3~gS6)xqoo7bW*$wd{+k_Rx?jH{HlA!%u{Oc$we2K==hhnz
z7lQ!pxb-;LTXP9@$vghCK5P%DZrp3S9CEf?uWJLcwdIb<p-|H%*BPM4d2sO6@@%)w
zio@3_I~mX*?6%~;gSL>Vy}ESu`p@QA!j0TB{S}B4(0gfpXja6)L{bnkTCy0>EFB}y
zi(=_%9W4^FSk0zNqIn<(F`^K2xN+<9)ErZ>28Gh)sX}3T(28=tde1l2D{7-_dwmsH
zP}}afN)QES+W?HNwppe0AWI9d0eS{zH&1V-X&l935M|6M4Tk%9MraXuBWdo_2zCK^
zEKTP*<RnXd;0Ib)qe0Kw@)(DlYRe<Ehl~-gi*Xh?V7jiSAQ6<$Q3S|md)_8ky4;wG
zAOMu^)_y3=HuGNzSf+rMf!`$HW7-QB3yidOB4qE_5mpTdJv~}3C>a^rbJMFQM=g9G
z9(fOf)a<AaCMbJO{20)h8Ie&8g0x$8`e~>cqD4GCm8T$dtXrz*n^l=@?Ss2PaCU|?
zfko-;rxEdPU!O)MpT>NbzGSd^<%s5kAW(g$69uA;@ra>hPlIdFi=Kex%i48xL}_HC
z4Llu+O;*6=>v!Aj<Qv4qUaQ**lI3ULRoMEjswU?KP!L%|j0};c3TIolU*lDsJD=)f
zigQG5=>({4j4a8NczsY!lN@mp1Zld-3aN0c*6IE&E%DOAM(D!;D6L^-NKxd;WCNh1
z8T3Z1-S1}!1(4R6J#-6sB)ef0NVdC&Cj(p?YxowiKwc}*$<Gx!DcZa3?F5BG$X<w9
zr9EJgazrb59D4Rzb%2h4um`0OiRv%jKmlpgz@T-FKBtJWwjIVh=zKA&wt<&0-y1WA
zSCVDveoLUc-?j-vA(mUvZjymz$=kZN;+1fCO0$r~PYjkFuT9O!FJm(xBRsZ>2r@xX
zicUp@y8~0mLN*Aoo`+7%4osG?IHGc4^QIF_Z+fTKsK8f*(5!IfBG{d_Res!Nprd~+
zjVC`tss;f|@a|rg1W@#hm@&URA+?b%IrK~yv*RCPrq~E4AP~Q`$zcpk0C|&Dm&bP@
zVbqYY1WmabF~w#1!G&rI<@i%wTAsFt_1AaYxyiJdrOKOGs`>8aw$RhPo1<FBEOxW|
zm%l`3Vv>fKbssy-z|&CY78ID*rn7~#$*x^zCmqj8y=N0fMgV0}cucE3S^jj63GU$V
zT~DD0GbVi9A5jQs@el-%9s>JZ7sOg?JJLxV3hv%Qyx$gw0iI5K-fDtnRM=F_sok(=
zP&IjjQGQ@|qlj8lyu>uc?b-8qp~hZ1K?tX3)YgxDeK=bcQvZE=`qo%KSRk#nTWEp2
zQ1P1(`?wsCo70)-^BF4F6Vw<UIr}S7V|c>`?()<$Q*Xd*hY<<103h9CN|y)cbDD#o
zyJW9?hB`)p7rf~yIe5+#spMEx9K>|0fwtxVq%_Mjzyde*g{CXzh&mJ-z)~h_k`h{g
z&NlObg3a=|x<}96Q3~jV@^&u+!8pur6rjWN?Uz58-L#PL0*DHUFOGN;vm^*<<i-|>
zFieKA@gU^3WZg^CATV9R%rWI);QBLrIOxotb}*NGU@E28S_X41PtFnJk3pzuneKr$
z*RDJ9ieWa_A1?d@0oqIdLDO=Fdr5#$(vrCV<^r&5<S}3+-C&+105OdhoMAmVL@AC^
zGYgx8SpE~vI_y=!gBe|Rj}+)#sZ9lGaMhMV{bWOW=yhib<nT3XE<RfHKWNzPY{&rs
zakx4bgyY5-1qSF;87%w)<u(UPP#7^!2!-Q)Zy#m_UDv~creGNHF2qzwi<<@2NF1J*
zvOL3y$|+sfP4bk^`wp6wVi%Xtl1TGGQ_LPQn!R{77biKcW=MZEb#%OeB(~@_Xg^F_
z9v?x=<8!N)%VV<}I*>9*)!BshQ2@)+(bi#yqDAR!jcx^;`04qfqtEhoCmi$M7|J;!
zH9NIbkjh%CqI1>5=G*GEZ6OPFzwHU*h=<Z%U4s_<HfLubwm#4l^Rr%#I%C{gyn=W(
z2L}&foy^ZMa)_a&j}HqVkmD#H9$I_(8LXGzoJx@IxBKa3h)c!1DI&`)Wu5#JbiyQH
zwFI8gkSLtCYHVm3io+!tDC9IXHnapLOLGgrsu8PY3zn>Jrrbc<i`K|D;-yiqcWv2T
z`~G8Ho6eZC^|l0@b2es()bc3p;ky9zR9<z;_aZ&Q#g*;xJA7g`W5W=~CR~DdqD}Vv
zJffW-^1bIuhxB1}9Mp&yhf8UfZ?iMT3I`$QCFM70ds@TgbYGrx(mv-EYz*AiARMtH
zym5ze&^yGNe1ed#PDS3FN-PD=Fnl08tvBL)otB`MS=Zj#*0p1JkN2Pk41)8TycjE5
zzE+T4je#;45L(vqC(^=Bco5CjMPMz$?OqqKx{b?&&D+{q)X`?<SPw-1xtZD>frTFg
zA+6);_3$QdOQVq+jw=v4j;L`1pr_wE00D5Qqw(?}yRAB6M9I@vDQZg=$yBh1lffz>
z23y+#K<tJeDE8Q4cc#_ywDi5$0O&fBCxnyUz2+>4YFVebB&-?J%*4pPX(KVF0G%`u
zBTS+ZFj*+VNgM|_l)5(s(%oYze86i@W{uc@r5kH5XT#%+$ntZ;j*A`+#qK~gTUx6s
zrmS3N`%T)kq{Htj!aqZnY=oAc)=Q8jXbG~UK9H(WN3Hq1rKpi@r9U2uO;%vKdwTKg
z1njlGdVHP_>r-j-_yC~ncFx0W6J#qo$IGbd4BCPmWkj2a2w^i3p{%xzDhX+1pF`QX
zHtZTpx#&9rAln6<Nf|b_%^H!Ap1yA=WV8-cLu7c{|Mo2}^QU~9SKl$8@J>{_QP`*{
zjR4N3GP@ILLqt;X-R-h{h1b?-#8}+Lo1Ju0`_Mdojk>lu?Aicb{Ve7OD2$e1G1x)$
z7Z9Mx9ZORiJU`WNI~yEwo@24~v4m}8uA8)wDep<35Y}VL((kMFYr20qk7kAvL}uPk
zGWCiF#*~MEkXVCAG>94=FT{4OS1BX~5u?gszD_r_vIZtCNm$ztoUXQ6rD$0mdyd}f
zTjfGY9Au+$!dMvV12VLw3!?LyFD_>g%m?Lxdg#*~*HP~*qOgM|kO~Ox$iQywzuRi=
zR`PJhx`3J`lRR?GD(aF()OG#cUJ9vHgoFnPkxEuX$Dbw@)#8E#Cb&2xaT4~#TalGn
zJIU=Z3Rmzz!p<)z-6RfbBuHpW1~j!c655F9-=g@uQeqBht&AWmHPCCKgs4NOv52%!
z4?-3vU4-qDfl#eEBD_Vm)k3`EuIV(4Bw?h3v0XCnhFqH#h5k5%W&m1SG7-wP4xejD
z7p?MrlfpO&AoW6GQPPFfESZqxn%kfGoL4;!)QicGcO*#&<!+1?p?6-=G1hAxvMGto
z#Y$qSigaI2_YBW~Qj;&i1o<)xI7<bV(I$0yCR?6eG=zg!WqCf2xhkV9p}EM}@eBs0
zXAp(yW+`>IjtvN9s8GJX_Xr7aGCNjBGScdpTl_fsNCO}=P9h|ahb1JM>~Y-}5S$*J
z0tDgUsRY4kDF~z=q<hOB8VJ*<x-4m!nzjFH{^aB#lu%g|M-p>LsNp3`{M)cNpj3p$
zHY^B9WcqvFv!}FJzvge*_3K^fl9knJb2@JGby{WWs2xtlIxELZm57m;6A?#I5Gnt#
zE2@-m^(Dm+el8ah(_b|Ranuo;2j_Dk|3zKbvGk*Yk&p{fXFbb*aeGOr1j0=R<atT=
zlGbZoSoOH$*CHF=)pQ<QeR2)Fvx|`n71x-vzZ5Sau(h&pmF<qz_XgyukswpwsJoY#
zDJrhZa+U9nhhn@4xj!-+4OJBVvk(vi-XIkr`P{uLi-X)8*46hT-0khbT8L1+ov2iI
zA`y{5urN#_L%9|M8`(4;7RNyp2ijLJ*TrGGm0D(L(J(K6xOzHO)nPwgwG4z1EDDlD
z0+TSj6zZyM4hm5kSb_Jkjf!#K9pEM})2D5=SzVEWA-n=R6nVC<(kegfAz5t2he1Ri
zn-{0xQ(ES0+ym%@w-Dj_JMlP7M4S-$pTtr9pM5Y1YCr$;q1f5vFWuP8{_}sKZpBN!
zUp>_+Q%{F)i@#r%uXO{u`=7fpB*f56)(5E$pZ1&8^_;BUN>$-krTJcUP6q@0&x6#8
zciH|_CpzP>d;%e{FAs*~cCdL#aQ&SkLV|>aLh>OA!qDe79K$FQktF1aZ6nqFfJQ`R
zjRZ0KpnWvkZlCXJ<;V6&T>fyik#=)>%&%QVzGmMW&khEMEMI68W*BXN$bDGIh)9^=
z@_4cPyiB=^)z?40&}}r4X2|LFpj$NU*s_&8COk>PC?-^LQvTHsr^dQ0nT3UFd9^!i
z)Wk9-CZ$;txla;@K_XN{BqpxI7t7O02pc?nB2o`o2l53Q8=GP|FRT!lWDzFGB4Cn*
zm?UGsBohmh%$7D!<>MPiQkDjW(EgZjf83s=jb?ifv)xm+S*2A~<WHwcstjfIeY?CH
z_diAhT+(K<#Pi~qO65}|oG_6DUiIeooj7|)2p1$4LVlwl(hrO<i&?2u+PVJrhG7y4
zNd{vZ9?G9%)PbyDi^I;AGVz?2l})e8zS)+a)34bouhMP49(ksmnI>GsvDE7I)Oc;_
z@?Fkr+IO*n7$ua9Uv6B4CZdDuyrko**M@NU^KkA1sk@DcneoeUi0#|hIHC@_uGzV~
zb&WT3YNRA2M4jI#Aw<N&C8TY7s5EvGl9+cPj7TJ9MbF22Q;cLDX!-tlswP-__cvth
zxUftZc`_3s9|al)oKx;9SG%1#o5Rj>#=q^huT^y{vj6|20`@Os1>-Dy^MJ!*-u>*)
zo-j<pASQ7f(1^$vU4Ndqe;cbXloX<z1%@!(S5{X=KH2R=SRg13IE`o$CCMa#V+(di
zgzz9Sb0qR~iw0_wJ*TJbgp{GXBU&F$MV^fh$K4;%_O#A7>FT9O_nQg&{ZhC<4;BWj
z*KGTiRrz{CH;*MSVGyf#6)|9S1nJ`ZTOW2RkwBHq?ciRW&Qpj=tc7s(HQSg*EQm!?
zJ0lX8yW>aq2?=L{Ct;`*u!!plnDB37)r^9W1zhMA<Hu~TnwpIFLKN9C&G)uHc{;uP
zGv990Rmh{Ue))MUB|ETxS8e-WaVyRrLcs|mYKKq={XPoah8XRxi(@YTYS&$tpLVNV
zy0)DDKc(Lfr|K7J(%B4+$(O19lhsDPtoxTX`)sUFePo{r?Th<pabDACF@SD_<L^!o
zd#+A%m*~SOk?q$9hXBp@Z|OGQtp4YhKdj<=w5pMCxO^U%iTb>xqpsI9)DCDL(xql9
zs_s6FIX$BvxlKrtfJc{4$NO#H#da`MBS72xeUDw{i6MC1<R2D8==p+v{kiH79*Fbg
zF#j&LlOvLZ1!3GfIqErk&-aTzXUjbpqu;cJUtHBq_IZ1FUrDZP^S!E4Zs3lrAMMC)
z*F#99+9PFAr}fl%Nw0se*CqiRp>G4A^qVVp0@&S$o2MysM$`NI*v=D=k{}XBE%~~%
z-fPvl;5l7q*G$JE+a0QNk=`_~#of6%0q!DfwIOW*g3_^z4&pY@k(%d^?h^^+oJlU9
zAAae|H=CWXK9!X<jCm@vl}c01%XBMcR<>C^9}0<fzdAhqL-J=u#!7$M`Q=ioX)M2Y
zn3(NPE=w8(n>FpLwOIG^|K+z_snzl*Pt<0WZ8O#Ge(af=4XT^0434aBtl|@4rJv{w
zj7|BR0c!_Y`89k0L`)}>o;m=)^s@n;=F$cLJgJ}n0q~@Beyqn9UOrG9tX@Hj#Q0Gs
zb!lo&c^Q^|VyDPhc&uYfFJ`$>XT!40cgOKX4^Sc$;^up0)6&Frvl)bTXL!vJm#iJ%
zgXbJ_;9Jf|)Qe|v<CiO;+q#XFR{;q^-9_@0R{7WQfh)EAm;KLa_4-BK-f8~H`=7ik
zJXl~rM)_M-sO-k=FBYmTjm^f%r7@K|sR8^!rMAPKE+D<hMy;hWDMI}rORG~cK2|X&
z`?^9E2N{}|#(LyokoC_P1T>$(Ul3p~Bgw1?4czf3%zdr||2z9>_2qAWT#*OjP^MP(
zM?J_C>ekzE0UeQmcYb|5?>riCOPm;#Y4P|$EX(0SI!vRDxm$_wnt#jf!y2q-EC|pZ
zH3QKyM}0OCu+T=N+X}(iR`h0LU)4cdPoX{Quu1Ys3)>MrXEf)#^d(zu((2=fGA1lx
zQRiEpm-KI0uUV3<ZO}e0@$o+RJ|ydLDzsiUTxXkK_Zed8x-6+(#rt)J?!WL1-C=|u
zDR1rw^Ml0BU562WEGd6{BC!+bhY|CR7=NAY+(X!z>^zL{gAe4rV1C?j{FfP#JqT$8
zYZt-g=jB}>p-fqvgz3llcSm41GjJLv^C!~>7V5=qv97FzL)%!DwICEsbZf#N!qC;p
zFYxbTEeWTpZk&r>J2)C=<kt?4AKSt4UwIqxKy|+rGn#488?Gde1?#7&2=Wk+D5NZi
zBN9<+bWJe^l8tQ!5k+!2x$Dh;c&&C@&!P65;vf>VbBfy~;}om4er?sSKestC)OljU
zTTV<8@gV35jk|55^}IUfmUC7Xww5J-&z^p+yH@{no-gxXyW{p@eLT9);mGa`f(2Z@
z>-q)OmacW_?V9!leroH|e_Q06m&^~w?CnAHxr1hryd)hl>_Q=_#!2UFL~)`FLk-MJ
zWy?jAbW?dG|FwTU`0x?ck|xqSKsdTLjm8(MIksJG>TcU;4FvQ3>6@Dnf6b(Ipo-@G
z+#35X$1I6Wucx+jh1st4B}C`fUACbQQA{Ep2CVticZmmRZn+0M=8Vf_y)oD6Nxlje
zq7R?RS2qtlN9DE~6Ot(DcH6((HaDC|4=wI=9{)oJ^CjJHo(|u>oQ`T<un$epk!9|O
zu17O%Nqgv;wf^-GED7W5r>nJqZ6Dj$j)=SnqJIPu`Npw;i1t%|>i8{3AW1~RyW@`7
zgJDP}MvU@f?%~rZ-`WNo{&)J8epwg!vHIyy*fhcVKU}?J@>xwQRi%+{v+|+z9RV)P
z->x8rkWatlpME5@rR(e3u4&)qi+t+K8nyG)a_q?nivkiF{n@TdSCyn)>kr`Qd^yLl
zvutDgYMiiu2BF@c?SKFGm*3`fGec|JdmL^o!1lkzA4(b`LgRPjVy0@58Sr3;nVd#y
zen^ip_uA)5nEzH6;yJgrWhgR94mEpG{`tSnNqNtnzUI~A`moy__K%zFS(*jq!&`YQ
z4#)C`-%<;sw56*MY1hoR)FEewMH-d*NbE3LBHikeBu$d;Ks@=ng{E6Nkx!?5cX}$}
zeRk1Q!h<#SrPeIo){;a2xXG6r@{r31S9h{rm#%o)wf-f&(@*9PMCuOOZ>RsZPf*)o
zXEX^DW=_R!dXGOgvzu(Bt^eRr<-|OtW%l?g)wyj}JgnEZP+HBMQV<MX=dyIYmF?OD
zN>BaC-TVIV^4)2;MGt~g7ON8(%TL4N*UvQz6J<c_7_15-p>Ze@-I?~XJ=rdHk+of%
zEPqz(|EnV1<cHN|w)x@t`D2nqq*7b!hWb~zF6p{&z1Fo$dbsu&uxf9<8q<qMF$**_
zq7Bn(WbB%WC<p?sM?bZttGsI0Jcx!!G!vlaxWmw=g|iTGx^|D*Qp`1X(6Wp5loB3L
zLi!5ZdYfna>M^hVx4y^e?zg5@ATPrE;icHP@i3h>^3xS}`XTzf<=OiXY25LZL>`aC
zc-5{;y1S)b>k~pfZjUe3SKr?9g*6!C@|V#_s+c0=hWac5xy(B@xO|F*t$F$5Q|(qC
zaZn;o0>||*7$Z3-xg&<I2bby?4XB+ye!mz^h~vZ>A;TnKQWeydO%0nyn;=x0j0xmj
z5v7vm&Nh3IM&IIi8okpCgSoXq8&7Oow`;bo2d~Qm31XrKV}|l)s82`GfpW?AXb=kx
zrTQojts9Gz7NkcDe#`z5>+gRmw(Xd<kCUv7ii8A4=9;#oSu4$&3y{~bJuj32{>*`=
z7P9GDJ~w6llyCFu`v*Aw<vwvNm@wg-mvlJwnnU!z%X{oQHv#XEhr6ulzCh8IG`~T!
zrdPhNi!77ZXdpJ^G~@fPj<$5&xLtFIc<<dAoAoK*$sjhI!`jjnNxL@9@BP39X=PbY
zqD6j*qGAawj7$(bp;13tn>_GDn!qe!BvhZ=WlmeRv1vRkP}5ElGVCULa(jT^Vp}Nf
zP<+h_l^T$JtA772Tc4`@u>ZL@eEaT?dUtM@t4EC07s%BF7c<8pk}rcWvbFyfx7g~&
zxgQdA{sG6NhfE(JgKoz4-(P<Bmp`{&f6wFTbltI##IfnRyDS;cwp!~ac$&Y2OQG#=
zV?6^*YLtw0gN%3EM!QSfv{I9lZSjFtrM9`G>)8QMY4OWzw#&{LEq_whsqeJ12ag_O
z@ueox>WGOcgkvhySJl44&+S+Ed#&Sob;|ocMPKTtXpj=_JTDrCYA&$x1YDQ2gW0T^
zTU(g&clA7b1;~fFw}+sh;P|`W@|ckzGoxs-MrsIuR0g{@4=#*iM#<&VC3$!pCrKQb
zU>G674EBgfn#jgvpO?+o@@t-Miu7GMM7{cxylBR6mq{vOo{%^h0uvG*Nc-Od#>1Gq
zWBL6iuMWis5pvb!nonopzlBHFB~77g)-)*pwLXlIW%md2OSY3*Us`;ZXuf`_PEY01
zh<;AXDtkJl#byM7oL8C0l!b=ZPg~Nruh+Ege^;b0ze}rhoNRUPAJw|OvHxXB+rL@U
zzy9HPI{rD^pMDrXz><WS0M1J~fO<^>@P~YxefchVu>1K?=0lIId;eZ&Ra?^bZ`O2)
zemLznb8g)YS_YCPaY)af`Yvo>8=GDg3PJ;62<Rd`zUFJ2J>^pk>jtSRM^PQm!Mh<I
z<jHmzQ=RV-N^7!H`<e(EF|$-E;;J@7fAtiWK^)|P1vJur#V$S7h9g!_t$AYQ--^xG
z_mA7}$Jd|Jm+Tj*BL07eO*TewC@u%FIDa}p^~G4sB+`!GAe1IVWb~O)#Q7<eKXC+w
zVmF22AqrW*L~2wpNjhN8+We@~LmvX>DuEk<B)6A_MCTGn`#|1<K}bF))9uG7lz3R@
z_6wF!!n%ebk;gR_(h}m*#FL+a5xt<dTpOmMA-c;^=|i@R5m(ywnMyyU`?s_lq*JFH
z%Q=fkvWW&EH95yf62;xa6a_S}n1wo?+uo?_eghEdH4VaV^J<qKFUKc)%h#hWy&H%!
zIYs9bw@U^s)Y<?LA9F?)!PuE|UNQm6wVrpQV~sn#8{^M_ybC%5{<!)2MIK|XPoSgD
zyB$Us<=wB(H)|FUUMKmTP;@EIS)%`T`(k>#*a#j<K@u1<q%W7QaTg8|pHuU<O9)u;
z^v_usMN)=Zg@A^~Z#dljIMgq0?by}dl^dN!(lC&Zs1doiE*bWNS{p{;vwQD?LErs$
zzl`OPyDn)Enl%rEdG_x-=KLXvrSe8%DZJFDaSg(OeXNf;6+-ls23l)NaU4rMNq!oh
z3pS9zYc(09<smHw{heu&FQyp`O@(GT&W^m7UH`AW59JS>M?_jil*&(@7+UE-s<ADQ
zKqC=Ji$oV|$87Hy6aSkwY`x8Xo0bCwuOFH9F;7Oxn7}JBeW}jur#_PzQJq9+=Xwii
z#~E`suOJ@G;Al7FJTQ>B+Y?wMfKAg>c4^d2uu&25um30?%I)5Fk;hd7Dx*l6RGo0h
zc}Wk4)NB33??q5_u3x~UxkDt+gpiM5Ct}QnpYVw)K#aNJT~ImZQe862_~hNPT)ur-
zKAx)FpV~80-A{NTf|wfMu1gni=QR!71;vls9Jhn0UW+W<`0}iTsr<QYcP16hfKgrd
zOQfN$JRCZNC?rgp??E5JxGYWmLdu^{<((A+TdFmcpQy{_;-JKDP5#GY<F9mXA3w<V
zArT2_KaE5tT@&Gf)Uy+#^<Y8*Nk3|w(@;toLX297odlD<WRKg!;rMtQ$|7*d>o|;q
zI5KK6w57}b=QX|EPQJ|s&LVk;O~cgHa6oGJD)O%9b4iUTV2m4F5kbPkz-R(-+UMUM
zH-}v+e^hx`f6b~v-jIhxse3^bsB&cH>?y^07|9)l0ZPiASa1_mB>!R%jsfLikcmme
z4oZy$MUqh3T-?U5K?2bSWogBn2Z9U90aX&J?e~PcC`2fcSamg8B?HIOLNUP9L3Trg
zZ1Un!-QcVkq6~SETDbn(mG=<Fsv(8h2`FYvk<++IvDEZQpE8@QdG`;+WBGb|ejW&<
zN)0fSSN!tnVi!?uY6E71l6SeoE~y#@QWtTF8+o8A)$7`Os-;R5Nh|sCIi6`YNTHNA
ziQv5(Z=sXVFG1u>&99%%;{I`T3JF(-E9pGfswge@7~JLoa%qkB1JuV5%by{22?wvd
z>BoY`kxJJ~n7rd=!x8gc6jI(MLoDK<5Xw_$zgN$x%9B`s^|~VNO&JZ(cF2)ECzx93
zjJZ}bz&f8`&$&ssR7awi2T~#%#zvx_8Yz3FW)lp_8Y$2tW`v81biWz*G>lKtmev_#
ziJ@p|OILcdYgRPtkH{6j9mqMQ?@<Xpuaq-Olc-Ch2t$#ugc?#V;t>l?4__E2iL@!H
z3(8=o_}qAgPt6R7^!KunHEuxcLEa=OJ(a^xUMXtW??&Gt%ezFASnBL%sd5r>RpQdI
z)N(0b{LzY$X0u472^0z)hPHIQ+U=Sie5|tw9tZ8E@u~GHDIf^A?xxn3u2|YNqq^X5
z%r=kD9@9~ZTN8w<kq3{Z%9IeJl%EsH7xPvNrJV6dbj0mr`JPwmhx)B~F2#Ky#ctGm
zIwU`nZ@MrO)KpK(C?aOXA!G9SHxf-vC_a<^-bh}aZ9TI7am-#G*N08E_R`7OVm1+R
zY)+NYmbA;$tm&6|{~{GlwX?s2!bn$#JS;@MyJm-~%hDA{yVe1c?E!$iR9_$WX_dca
zk4=&4=5d$qrTy>2MIKyk5NX=6m_-I_<dRfOjHp|^78sq3JwSYqwTmEj9PN^UL#^rZ
zwZYKVV^-gf{u?BM(6Ag0??XRH-3CIcQc~SEGUhEH1}b>(L5in3DdF+*CU5GrguzEJ
zc!<pURF@Geg@`oW%t<Jbd_O5MV<ysyl_p6z7MaIT>HrfCZDBO9P-Qd_oBpz{lUjz2
zllzCW?U1}eCvqlwSO{aQJd<yuYJk&mvxjOF8oBy#^{+Z`E^P9hQK<(I!{8{tmxD!y
zW<DBmNis|AB~N%D4Ik51R!&w<Z6HRduXo4Nb*&7#3rS2^6iI$c%|I%B#C3NWXHmz$
z%VVjj24;<e)VX6p5_8sku}do{+}FjyD_Tc)icp#}GqSF<CC#hRtm)qVB9&4jd&~BI
zb^88D&QAB^X?J{l+2&89TyxHj5z-WrCq{>HUD7&6G;11+e|~>CRN0t^SE`FiV?Rlu
zD3w9xkQf%fGUqXkDKSZ+j$3FXc5V+ZFLg&>ubp#m6sirK@*7C0=`T9zAaO;ec%7)l
zhk(c*LL#FYM@=Lv-jtbRUTN<Yx<7qhwuh&5tK%7#G51H+ImbXp$nO!n^BHn7Ygqyr
z!cWS+VSya5$oxO2sn`!nXiIvyzFu?redJ^Hu=CBEy+58!USw;@vhR=Ysj}+}sbd_f
z{Q3LRgz7zA1HB2OgooEpXIGzo2;YW>g$bvD5yH>%eN{ZZ7wPdh@Pyr;HrLqbu+~jG
zaNMQjy_mL@GK2|XdOtSV)9GcLKb|~v&`<{&X}t0vG=c+GG=hY}ubQ?|zj48nu}(#c
zpH*AZSl6t%?*Fi3JP|~--)cV{cBLi$Cbjrj8ExjF4p|aJwj_};;(BBk_v^+!Eax>H
zOIp1?DrH2~D13zTO7&?cNn#>7FX>3?HC=yKy?@G6?(3K3Z2l1|*Qb#&#_Ddbp_x!9
z*C<Jh47xP0R1I=tIGn|?&+T9&3>#Jy4Mfa{(H24;5Gm2j-eqARZ78!vmlec_drf{6
zi;$-wH2m)-7H`T$s2@${ye1=&5UJl79;*&jhN!_z&cruh;4BE3kznEA%m}f@Oy)$l
zz^S{8`1OXeI{DvdXAW*Z5Ued-L9}c7Ma_5PNI)KhIXi{8-W{cCN|~)=5h@ec^h7a1
z6Be05Lt*i{bWH^AhL9r>u!KfNzDxO<7SfR0Wjn=|;jF13a*dNQYl4z6s(qRoo(se)
zo*)*~tg$fg40IkGN1DEK$O=W76^RjTHAyqrxy*S|EdZ`d`t6N6*@qWzX%pEThA`59
zYtd)5CC#VVtho_=gfscWz>LvH?vAO2vOa9Ld6^&fQqUFqA*=uHsP+;_i>yqa{S7_u
z4#teuFABxQt!3#`rB(S@4Ys+N0m(Ud;1@i!+rG_do>@CcCY``={nwI!+l@s(6ynqK
zO_RQ7Dyk*IScfP?1v2bdKA=9q0i#_qVT6VjQzz7YQ$c%k(uHoN{X;5S567o(zF8RV
zQxk+FG;6!AOM2X^Uh7sVe$Y?tq>(6xPPsnpJ)>8I)5fxBt#X^7W{$D7NEp@ifV4X7
z^7UhpJxfV(@);HKQo2lB`}XH0V|%rxe{;vkt@;EE4m#-+C%9Z(RI15R`$-1i(OB8O
zQTHHTwCQpf(8%zW1(3F+)i5?|z4|?=>W=Cdar5_fm{x;2+Q%P|4w8CwRqoGbx<86h
zp0j)07V|g`NQ?W^VS)3|q^qXY>uv3gnJV};yC+<hw6fA>%?vFa<<8QkKW6LvIrk<u
zfBg1s;$<_F$XmDPY#b7>piYz36K#~y-YKY+PlkwzYwMchvu=NN><=9_Ps@z18^2zP
zO%t_V3kkFCJrtJu_`T0Td0*Pb-CJq5PJ#h%<Ne;fDYfNupwQ_tGJG;CrbVEb`$Y6X
zE+=&iDhfiQHj@~IvzC2q<;y(eNfI&LN~v3DWRK5<`q#ehxXUW3B9x;dCsY+kQYKA9
z#z<t$b|z+(Ems8sMwPD`(a1~z7RNk};$G;)0<wvys6><Eakzr%PAKQ6hR(WiGgvxx
zCoWw#j8t<tqkpKi?nIs>CVDe#gNHESTzQlUk^e)UOjkXLWgqKTmq>YHRLuTEiu0|t
zF@ef1$g{#>23eNB?T*LCb`Dfqp8TBFu?PP#3MiL%Q;k<nVwUJ>p?Vow9PuC)!60`N
zlE}ZRUrY}!Uq;uxVYP=YEx+&AEv^A?cM_^94K<)xUJ1kb#QccllJdSATC6H`iK5;>
z>)=6NqEIThT;8}aVcb;~IQ5JFYi)C7<HJi{<u7|<G;A;EYCdtU;v>~Dvg!JwHBCqo
z8ko`|4&^gNj9w~bGv(cKDP42w%TsRiaI`<@!Q*)pf$>W(;@9I*g78=nW8^`UNHG->
zqr^=$8CA(Z10{D;eQD}&2Z2!$qb*%`Z`b;y^jyX8A(7HLPNMUtv&t_Dh*E+z5E@mq
zvK)D}iP3&SaYw3hDsu3c?ceg^u-_^1^_CX7vUI&!pUx&qJd%oZCo%ZCbj8!Ibsdbs
zLlgz7RE0L5#zP$WzqgI`LXx8Uy))N&JvS&@Jr##{si8bn&igiAsf^_Av3z`Wpw}hs
zj5cc;(7*ovH^2My@0Uc-BS`){Kb)Sva_?_lW^3j2ut~1(<vQK^`zX1`7gM4{nNjw6
zUD7&^G;4bLV|w&ed%EP48idTbG15v~(u(Svwf;~~msi>LgKgi0NZVZA!0r#G57D`2
zas6p1w!sZ|T(G(WqD8=ZS`*L*YV_TUT%*iw5|+uY8WK~Y#j(_n`(zYq;*9oXjad=&
zCW$7Md&6V$oB#RcKmYRAFJsP!>7ofDse0-MQrZntDKY!qiGU>`7iKBR#@ZM9`FVHD
zZ0-LV-(_*A4(o$|;^N3apL`L+kQ*knT8cUeef3|9&5k)W#z&PgfAF>%9U1F$AZeFO
zB)sP|AYF0hx^qA9h4XEd6}ArkEhz>k*LftaneHf6*}%|mZIn>0%B9$i`#eccoBVJo
zp8kL^Y#)%eq~%{WYkfd(`6gQu(5+GMn;G%D-~a3sBcsQ;apfS1&4lRdl3t}zuXUn4
zR=1WEH)Hy{+#6qU+CR$oUkgNiM4I&N?JaA<EP|o0^~gsezJ59b(*1pGv}Yoe&$1!L
zYCm{YoYo#c_)HWZldv!s^A~Qg>dInhzzt;$%*C(qc?@&im(dZdA3Yurr*uN(eir((
zhd2~c`DN{=ySHa=7n{;0NEE0faNPj04^GLx*&-rezN!}V|9L2@$7lIJB!!;y7hjKT
z{=kxi1VoxGL|Q&vf9Z6OBj<sXty~YnMk<=XI)+*xwFP0c0kuMU%#WVvKk0y?&eogb
zP;pgu$BYss2daU|++A3%UMi!hMdL6C$RMt!EW$tdDq@r~u7>we8XG+^OfTO^X!2Vs
zdu<dWy*=1FxZ)pXrJ&|i7B9&FnJNEK6$kG*3q%~()gYV@)!f2aI>75bhK7EwE$Ph@
z>NO49m@zWWa#t0B=v1SHlm-bmjSqR{SQ1B;T}LMVe9WfPd&<yG>4>}RS2TVYf8_|1
z=iY3u-i4%cWBf^A)LqPC*oC$_9}A>*Z2*!tkM-_|ZtI)00QZ(h<RBHmvAVe}mwUK|
zg-X{Yy<DMQ>w8gEr~7kQIv|F;VSa&QeUT!m_ff<5p;R`X!&oVeJQ7hH(U^xMhz+tE
zWv*8V=fx1lOln?6-SeTSY@RypP5MKTWxsqsdS|E*`al@fe(TgSGLf$12CsF|%2i~J
zUS;y!s#*p6EBQ-tsu4Z@(u57YiUsfda`_3O8kuo)lbDe>GLH+3Bo&22bFD_;8SA-A
z<X%Y-8F(&BS3K?7kUHU4?&CzKkZ>sX7T&2*n(}a(MHhjHxG>TQY`pv1@BaLM1||}Y
zb3WENyu=)5d}XGV@XF<NN*s#UOS;>okNd-ZU{ugZhbRq`h%uv9QzhI|k(lKGQ4r81
z>Q%kO52^{@<+stDhTm|TROgDwkhkT_)_UuIPV>Fjf>7N~%-^n8Dp8e2Mh3R^Ldl~S
z^VmEs_0ZaSK&*c>+MGa^rpcFey3LAqq~L%p<;o3L=O9TEvp<A-i4(KDTdh%IT6OBu
zKBwyeLb#{Z$?GVsC*zi0m$U+zX00EI2#wz^`_QtDmBJB`*VE`DmG9Tv)5aDJINu6)
zI}Vl7DD>a1Y)%>x5j8n${#Qnc4+CEJ0QiR7M$W@11`dM_OB^ReP`ljp4seK_qLL56
zusn2en8cFvMxltb-EG0&FJJ$stSO})zFTsNq?~3-VCskUx}>G?H*1#Q#9e-{e5lP*
zU1OWjzmJu-Jd`&*G%osJ_CI~#(YT4+Bq4F2_vp1*;!=H3Pn^!!?D;ucJJiyjPTTFz
z2YDU6YL+V!M-!ERW28K2OIJ+o+Q@3uAN#31QUh}3%fN~JQ)Q6ovMusc)TZVuzeXY%
zqnlSnmVP~^*7DExk9?MhkS3sh){JZwnuO{c>7W7;s467G@1=|+Zd6*ivf}FX$IWTy
z?R7>TLbLI)D`(RJupVAsPyNviG)daTIEV5_<O;@$u9U3t_cNicN7uH$nqL%jdQ}UR
zCToN;vTy6`SgC#jO-Y!){R3y(Y<3bD$7leLmI-7=qnTlX>5Lgylf#7h2)L{-8zvD;
z8P*x%Bj0vq!a6Ydb4tw9;u;Gu8VLzP$uBRrd|u@rAPlEW<$fD*n2=AXG0ft8cpu-3
zyt*H4>|g|oB6I%UU>hEHg0E%Q>(X`Cc1_#0u3%29Y^BcWN)cng&GqpRE?j6kL=X2)
zzXJ%>q_rL9H22n>Q#iJq`{RLJTZXk$trkPlNUUxCw0<m4N9BN<n<+g>wHz_prdUfd
zBU}7LT!lnEuxeOd&u~*0kWrmmvGfgXbMKeBq+NkE&;H$_pimm;my~rQX(;yZVpXxj
zP=%L!&K;@B>zVOpoMS+hx7r%=uZ7$&fYkUMn?cz|*=>I$t>A;23TZ1AZD-juf8|mB
zoqCeZ2bArrxm+v|x;I2y(sJ^fHN7{R71BpksZYgpW5nb3uik!V#bbys>@3K+`5V^9
z*Jq*6al*21sp`0AyDR5EdaTDd*BzynV1)HZJhtGLxSlgzh3+;<=hugm_rPqfq~rGV
zlJ6~luuIpL)n5*F!TX$ld(8J`r5<0kR6dlxx6kyvbK&G&?N>J%#Ar)eN?WtmBkHdk
zjowK2(eK}~qOx{eu%C*{e_@<~Uys0@HX7Od^Y#<)_uu^T(|`WyzrOt9E*E?Vf{@XK
z5SFNseSve1X+(KKm{H4Nna`!d6LDZE^^VC^GDgfy^$ucxJ3ppoJw$>Vk}*^Tr->k4
tvT8s0T3&ih2GEq%UZ;vF|LK4HuTz;7EuGVs?f?3}{|^A*w1@bc9RLU(AF%)c

literal 0
HcmV?d00001

diff --git a/vendor/gopkg.in/square/go-jose.v2/jwe.go b/vendor/gopkg.in/square/go-jose.v2/jwe.go
new file mode 100644
index 0000000..b5a6dcd
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/jwe.go
@@ -0,0 +1,294 @@
+/*-
+ * Copyright 2014 Square Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package jose
+
+import (
+	"encoding/base64"
+	"fmt"
+	"strings"
+
+	"gopkg.in/square/go-jose.v2/json"
+)
+
+// rawJSONWebEncryption represents a raw JWE JSON object. Used for parsing/serializing.
+type rawJSONWebEncryption struct {
+	Protected    *byteBuffer        `json:"protected,omitempty"`
+	Unprotected  *rawHeader         `json:"unprotected,omitempty"`
+	Header       *rawHeader         `json:"header,omitempty"`
+	Recipients   []rawRecipientInfo `json:"recipients,omitempty"`
+	Aad          *byteBuffer        `json:"aad,omitempty"`
+	EncryptedKey *byteBuffer        `json:"encrypted_key,omitempty"`
+	Iv           *byteBuffer        `json:"iv,omitempty"`
+	Ciphertext   *byteBuffer        `json:"ciphertext,omitempty"`
+	Tag          *byteBuffer        `json:"tag,omitempty"`
+}
+
+// rawRecipientInfo represents a raw JWE Per-Recipient header JSON object. Used for parsing/serializing.
+type rawRecipientInfo struct {
+	Header       *rawHeader `json:"header,omitempty"`
+	EncryptedKey string     `json:"encrypted_key,omitempty"`
+}
+
+// JSONWebEncryption represents an encrypted JWE object after parsing.
+type JSONWebEncryption struct {
+	Header                   Header
+	protected, unprotected   *rawHeader
+	recipients               []recipientInfo
+	aad, iv, ciphertext, tag []byte
+	original                 *rawJSONWebEncryption
+}
+
+// recipientInfo represents a raw JWE Per-Recipient header JSON object after parsing.
+type recipientInfo struct {
+	header       *rawHeader
+	encryptedKey []byte
+}
+
+// GetAuthData retrieves the (optional) authenticated data attached to the object.
+func (obj JSONWebEncryption) GetAuthData() []byte {
+	if obj.aad != nil {
+		out := make([]byte, len(obj.aad))
+		copy(out, obj.aad)
+		return out
+	}
+
+	return nil
+}
+
+// Get the merged header values
+func (obj JSONWebEncryption) mergedHeaders(recipient *recipientInfo) rawHeader {
+	out := rawHeader{}
+	out.merge(obj.protected)
+	out.merge(obj.unprotected)
+
+	if recipient != nil {
+		out.merge(recipient.header)
+	}
+
+	return out
+}
+
+// Get the additional authenticated data from a JWE object.
+func (obj JSONWebEncryption) computeAuthData() []byte {
+	var protected string
+
+	if obj.original != nil && obj.original.Protected != nil {
+		protected = obj.original.Protected.base64()
+	} else if obj.protected != nil {
+		protected = base64.RawURLEncoding.EncodeToString(mustSerializeJSON((obj.protected)))
+	} else {
+		protected = ""
+	}
+
+	output := []byte(protected)
+	if obj.aad != nil {
+		output = append(output, '.')
+		output = append(output, []byte(base64.RawURLEncoding.EncodeToString(obj.aad))...)
+	}
+
+	return output
+}
+
+// ParseEncrypted parses an encrypted message in compact or full serialization format.
+func ParseEncrypted(input string) (*JSONWebEncryption, error) {
+	input = stripWhitespace(input)
+	if strings.HasPrefix(input, "{") {
+		return parseEncryptedFull(input)
+	}
+
+	return parseEncryptedCompact(input)
+}
+
+// parseEncryptedFull parses a message in compact format.
+func parseEncryptedFull(input string) (*JSONWebEncryption, error) {
+	var parsed rawJSONWebEncryption
+	err := json.Unmarshal([]byte(input), &parsed)
+	if err != nil {
+		return nil, err
+	}
+
+	return parsed.sanitized()
+}
+
+// sanitized produces a cleaned-up JWE object from the raw JSON.
+func (parsed *rawJSONWebEncryption) sanitized() (*JSONWebEncryption, error) {
+	obj := &JSONWebEncryption{
+		original:    parsed,
+		unprotected: parsed.Unprotected,
+	}
+
+	// Check that there is not a nonce in the unprotected headers
+	if parsed.Unprotected != nil {
+		if nonce := parsed.Unprotected.getNonce(); nonce != "" {
+			return nil, ErrUnprotectedNonce
+		}
+	}
+	if parsed.Header != nil {
+		if nonce := parsed.Header.getNonce(); nonce != "" {
+			return nil, ErrUnprotectedNonce
+		}
+	}
+
+	if parsed.Protected != nil && len(parsed.Protected.bytes()) > 0 {
+		err := json.Unmarshal(parsed.Protected.bytes(), &obj.protected)
+		if err != nil {
+			return nil, fmt.Errorf("square/go-jose: invalid protected header: %s, %s", err, parsed.Protected.base64())
+		}
+	}
+
+	// Note: this must be called _after_ we parse the protected header,
+	// otherwise fields from the protected header will not get picked up.
+	var err error
+	mergedHeaders := obj.mergedHeaders(nil)
+	obj.Header, err = mergedHeaders.sanitized()
+	if err != nil {
+		return nil, fmt.Errorf("square/go-jose: cannot sanitize merged headers: %v (%v)", err, mergedHeaders)
+	}
+
+	if len(parsed.Recipients) == 0 {
+		obj.recipients = []recipientInfo{
+			{
+				header:       parsed.Header,
+				encryptedKey: parsed.EncryptedKey.bytes(),
+			},
+		}
+	} else {
+		obj.recipients = make([]recipientInfo, len(parsed.Recipients))
+		for r := range parsed.Recipients {
+			encryptedKey, err := base64.RawURLEncoding.DecodeString(parsed.Recipients[r].EncryptedKey)
+			if err != nil {
+				return nil, err
+			}
+
+			// Check that there is not a nonce in the unprotected header
+			if parsed.Recipients[r].Header != nil && parsed.Recipients[r].Header.getNonce() != "" {
+				return nil, ErrUnprotectedNonce
+			}
+
+			obj.recipients[r].header = parsed.Recipients[r].Header
+			obj.recipients[r].encryptedKey = encryptedKey
+		}
+	}
+
+	for _, recipient := range obj.recipients {
+		headers := obj.mergedHeaders(&recipient)
+		if headers.getAlgorithm() == "" || headers.getEncryption() == "" {
+			return nil, fmt.Errorf("square/go-jose: message is missing alg/enc headers")
+		}
+	}
+
+	obj.iv = parsed.Iv.bytes()
+	obj.ciphertext = parsed.Ciphertext.bytes()
+	obj.tag = parsed.Tag.bytes()
+	obj.aad = parsed.Aad.bytes()
+
+	return obj, nil
+}
+
+// parseEncryptedCompact parses a message in compact format.
+func parseEncryptedCompact(input string) (*JSONWebEncryption, error) {
+	parts := strings.Split(input, ".")
+	if len(parts) != 5 {
+		return nil, fmt.Errorf("square/go-jose: compact JWE format must have five parts")
+	}
+
+	rawProtected, err := base64.RawURLEncoding.DecodeString(parts[0])
+	if err != nil {
+		return nil, err
+	}
+
+	encryptedKey, err := base64.RawURLEncoding.DecodeString(parts[1])
+	if err != nil {
+		return nil, err
+	}
+
+	iv, err := base64.RawURLEncoding.DecodeString(parts[2])
+	if err != nil {
+		return nil, err
+	}
+
+	ciphertext, err := base64.RawURLEncoding.DecodeString(parts[3])
+	if err != nil {
+		return nil, err
+	}
+
+	tag, err := base64.RawURLEncoding.DecodeString(parts[4])
+	if err != nil {
+		return nil, err
+	}
+
+	raw := &rawJSONWebEncryption{
+		Protected:    newBuffer(rawProtected),
+		EncryptedKey: newBuffer(encryptedKey),
+		Iv:           newBuffer(iv),
+		Ciphertext:   newBuffer(ciphertext),
+		Tag:          newBuffer(tag),
+	}
+
+	return raw.sanitized()
+}
+
+// CompactSerialize serializes an object using the compact serialization format.
+func (obj JSONWebEncryption) CompactSerialize() (string, error) {
+	if len(obj.recipients) != 1 || obj.unprotected != nil ||
+		obj.protected == nil || obj.recipients[0].header != nil {
+		return "", ErrNotSupported
+	}
+
+	serializedProtected := mustSerializeJSON(obj.protected)
+
+	return fmt.Sprintf(
+		"%s.%s.%s.%s.%s",
+		base64.RawURLEncoding.EncodeToString(serializedProtected),
+		base64.RawURLEncoding.EncodeToString(obj.recipients[0].encryptedKey),
+		base64.RawURLEncoding.EncodeToString(obj.iv),
+		base64.RawURLEncoding.EncodeToString(obj.ciphertext),
+		base64.RawURLEncoding.EncodeToString(obj.tag)), nil
+}
+
+// FullSerialize serializes an object using the full JSON serialization format.
+func (obj JSONWebEncryption) FullSerialize() string {
+	raw := rawJSONWebEncryption{
+		Unprotected:  obj.unprotected,
+		Iv:           newBuffer(obj.iv),
+		Ciphertext:   newBuffer(obj.ciphertext),
+		EncryptedKey: newBuffer(obj.recipients[0].encryptedKey),
+		Tag:          newBuffer(obj.tag),
+		Aad:          newBuffer(obj.aad),
+		Recipients:   []rawRecipientInfo{},
+	}
+
+	if len(obj.recipients) > 1 {
+		for _, recipient := range obj.recipients {
+			info := rawRecipientInfo{
+				Header:       recipient.header,
+				EncryptedKey: base64.RawURLEncoding.EncodeToString(recipient.encryptedKey),
+			}
+			raw.Recipients = append(raw.Recipients, info)
+		}
+	} else {
+		// Use flattened serialization
+		raw.Header = obj.recipients[0].header
+		raw.EncryptedKey = newBuffer(obj.recipients[0].encryptedKey)
+	}
+
+	if obj.protected != nil {
+		raw.Protected = newBuffer(mustSerializeJSON(obj.protected))
+	}
+
+	return string(mustSerializeJSON(raw))
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/jwe_test.go b/vendor/gopkg.in/square/go-jose.v2/jwe_test.go
new file mode 100644
index 0000000..c5c5f96
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/jwe_test.go
@@ -0,0 +1,619 @@
+/*-
+ * Copyright 2014 Square Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package jose
+
+import (
+	"bytes"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rsa"
+	"crypto/x509"
+	"math/big"
+	"regexp"
+	"testing"
+)
+
+func TestCompactParseJWE(t *testing.T) {
+	// Should parse
+	msg := "eyJhbGciOiJSU0EtT0FFUCIsImVuYyI6IkExMjhHQ00ifQ.dGVzdA.dGVzdA.dGVzdA.dGVzdA"
+	_, err := ParseEncrypted(msg)
+	if err != nil {
+		t.Error("Unable to parse valid message:", err)
+	}
+
+	// Messages that should fail to parse
+	failures := []string{
+		// Too many parts
+		"eyJhbGciOiJSU0EtT0FFUCIsImVuYyI6IkExMjhHQ00ifQ.dGVzdA.dGVzdA.dGVzdA.dGVzdA.dGVzdA",
+		// Not enough parts
+		"eyJhbGciOiJSU0EtT0FFUCIsImVuYyI6IkExMjhHQ00ifQ.dGVzdA.dGVzdA.dGVzdA",
+		// Invalid encrypted key
+		"eyJhbGciOiJSU0EtT0FFUCIsImVuYyI6IkExMjhHQ00ifQ.//////.dGVzdA.dGVzdA.dGVzdA",
+		// Invalid IV
+		"eyJhbGciOiJSU0EtT0FFUCIsImVuYyI6IkExMjhHQ00ifQ.dGVzdA.//////.dGVzdA.dGVzdA",
+		// Invalid ciphertext
+		"eyJhbGciOiJSU0EtT0FFUCIsImVuYyI6IkExMjhHQ00ifQ.dGVzdA.dGVzdA.//////.dGVzdA",
+		// Invalid tag
+		"eyJhbGciOiJSU0EtT0FFUCIsImVuYyI6IkExMjhHQ00ifQ.dGVzdA.dGVzdA.dGVzdA.//////",
+		// Invalid header
+		"W10.dGVzdA.dGVzdA.dGVzdA.dGVzdA",
+		// Invalid header
+		"######.dGVzdA.dGVzdA.dGVzdA.dGVzdA",
+		// Missing alc/enc params
+		"e30.dGVzdA.dGVzdA.dGVzdA.dGVzdA",
+	}
+
+	for _, msg := range failures {
+		_, err = ParseEncrypted(msg)
+		if err == nil {
+			t.Error("Able to parse invalid message", msg)
+		}
+	}
+}
+
+func TestFullParseJWE(t *testing.T) {
+	// Messages that should succeed to parse
+	successes := []string{
+		// Flattened serialization, single recipient
+		"{\"protected\":\"eyJhbGciOiJYWVoiLCJlbmMiOiJYWVoifQo\",\"encrypted_key\":\"QUJD\",\"iv\":\"QUJD\",\"ciphertext\":\"QUJD\",\"tag\":\"QUJD\"}",
+		// Unflattened serialization, single recipient
+		"{\"protected\":\"\",\"unprotected\":{\"enc\":\"XYZ\"},\"recipients\":[{\"header\":{\"alg\":\"XYZ\"},\"encrypted_key\":\"QUJD\"}],\"iv\":\"QUJD\",\"ciphertext\":\"QUJD\",\"tag\":\"QUJD\"}",
+	}
+
+	for i := range successes {
+		_, err := ParseEncrypted(successes[i])
+		if err != nil {
+			t.Error("Unble to parse valid message", err, successes[i])
+		}
+	}
+
+	// Messages that should fail to parse
+	failures := []string{
+		// Empty
+		"{}",
+		// Invalid JSON
+		"{XX",
+		// Invalid protected header
+		"{\"protected\":\"###\"}",
+		// Invalid protected header
+		"{\"protected\":\"e1gK\"}",
+		// Invalid encrypted key
+		"{\"protected\":\"e30\",\"encrypted_key\":\"###\"}",
+		// Invalid IV
+		"{\"protected\":\"e30\",\"encrypted_key\":\"QUJD\",\"iv\":\"###\"}",
+		// Invalid ciphertext
+		"{\"protected\":\"e30\",\"encrypted_key\":\"QUJD\",\"iv\":\"QUJD\",\"ciphertext\":\"###\"}",
+		// Invalid tag
+		"{\"protected\":\"e30\",\"encrypted_key\":\"QUJD\",\"iv\":\"QUJD\",\"ciphertext\":\"QUJD\",\"tag\":\"###\"}",
+		// Invalid AAD
+		"{\"protected\":\"e30\",\"encrypted_key\":\"QUJD\",\"iv\":\"QUJD\",\"ciphertext\":\"QUJD\",\"tag\":\"QUJD\",\"aad\":\"###\"}",
+		// Missing alg/enc headers
+		"{\"protected\":\"e30\",\"encrypted_key\":\"QUJD\",\"iv\":\"QUJD\",\"ciphertext\":\"QUJD\",\"tag\":\"QUJD\"}",
+		// Missing enc header
+		"{\"protected\":\"eyJhbGciOiJYWVoifQ\",\"encrypted_key\":\"QUJD\",\"iv\":\"QUJD\",\"ciphertext\":\"QUJD\",\"tag\":\"QUJD\"}",
+		// Missing alg header
+		"{\"protected\":\"eyJlbmMiOiJYWVoifQ\",\"encrypted_key\":\"QUJD\",\"iv\":\"QUJD\",\"ciphertext\":\"QUJD\",\"tag\":\"QUJD\"}",
+		// Unflattened serialization, single recipient, invalid encrypted_key
+		"{\"protected\":\"\",\"recipients\":[{\"header\":{\"alg\":\"XYZ\", \"enc\":\"XYZ\"},\"encrypted_key\":\"###\"}],\"iv\":\"QUJD\",\"ciphertext\":\"QUJD\",\"tag\":\"QUJD\"}",
+		// Unflattened serialization, single recipient, missing alg
+		"{\"protected\":\"eyJhbGciOiJYWVoifQ\",\"recipients\":[{\"encrypted_key\":\"QUJD\"}],\"iv\":\"QUJD\",\"ciphertext\":\"QUJD\",\"tag\":\"QUJD\"}",
+	}
+
+	for i := range failures {
+		_, err := ParseEncrypted(failures[i])
+		if err == nil {
+			t.Error("Able to parse invalid message", err, failures[i])
+		}
+	}
+}
+
+func TestMissingInvalidHeaders(t *testing.T) {
+	protected := &rawHeader{}
+	protected.set(headerEncryption, A128GCM)
+
+	obj := &JSONWebEncryption{
+		protected:   protected,
+		unprotected: &rawHeader{},
+		recipients: []recipientInfo{
+			{},
+		},
+	}
+
+	_, err := obj.Decrypt(nil)
+	if err != ErrUnsupportedKeyType {
+		t.Error("should detect invalid key")
+	}
+
+	obj.unprotected.set(headerCritical, []string{"1", "2"})
+
+	_, err = obj.Decrypt(nil)
+	if err == nil {
+		t.Error("should reject message with crit header")
+	}
+
+	obj.unprotected.set(headerCritical, nil)
+	obj.protected = &rawHeader{}
+	obj.protected.set(headerAlgorithm, RSA1_5)
+
+	_, err = obj.Decrypt(rsaTestKey)
+	if err == nil || err == ErrCryptoFailure {
+		t.Error("should detect missing enc header")
+	}
+}
+
+func TestRejectUnprotectedJWENonce(t *testing.T) {
+	// No need to test compact, since that's always protected
+
+	// Flattened JSON
+	input := `{
+	"header":  {
+		"alg": "XYZ", "enc": "XYZ",
+		"nonce": "should-cause-an-error"
+	},
+	"encrypted_key": "does-not-matter",
+	"aad": "does-not-matter",
+	"iv": "does-not-matter",
+	"ciphertext": "does-not-matter",
+	"tag": "does-not-matter"
+	}`
+	_, err := ParseEncrypted(input)
+	if err == nil {
+		t.Error("JWE with an unprotected nonce parsed as valid.")
+	} else if err.Error() != "square/go-jose: Nonce parameter included in unprotected header" {
+		t.Errorf("Improper error for unprotected nonce: %v", err)
+	}
+
+	input = `{
+		"unprotected":  {
+			"alg": "XYZ", "enc": "XYZ",
+			"nonce": "should-cause-an-error"
+		},
+		"encrypted_key": "does-not-matter",
+		"aad": "does-not-matter",
+		"iv": "does-not-matter",
+		"ciphertext": "does-not-matter",
+		"tag": "does-not-matter"
+	}`
+	_, err = ParseEncrypted(input)
+	if err == nil {
+		t.Error("JWE with an unprotected nonce parsed as valid.")
+	} else if err.Error() != "square/go-jose: Nonce parameter included in unprotected header" {
+		t.Errorf("Improper error for unprotected nonce: %v", err)
+	}
+
+	// Full JSON
+	input = `{
+		"header":  { "alg": "XYZ", "enc": "XYZ" },
+		"aad": "does-not-matter",
+		"iv": "does-not-matter",
+		"ciphertext": "does-not-matter",
+		"tag": "does-not-matter",
+		"recipients": [{
+			"header": { "nonce": "should-cause-an-error" },
+			"encrypted_key": "does-not-matter"
+		}]
+	}`
+	_, err = ParseEncrypted(input)
+	if err == nil {
+		t.Error("JWS with an unprotected nonce parsed as valid.")
+	} else if err.Error() != "square/go-jose: Nonce parameter included in unprotected header" {
+		t.Errorf("Improper error for unprotected nonce: %v", err)
+	}
+}
+
+func TestCompactSerialize(t *testing.T) {
+	// Compact serialization must fail if we have unprotected headers
+	obj := &JSONWebEncryption{
+		unprotected: &rawHeader{},
+	}
+	obj.unprotected.set(headerAlgorithm, "XYZ")
+
+	_, err := obj.CompactSerialize()
+	if err == nil {
+		t.Error("Object with unprotected headers can't be compact serialized")
+	}
+}
+
+func TestVectorsJWE(t *testing.T) {
+	plaintext := []byte("The true sign of intelligence is not knowledge but imagination.")
+
+	publicKey := &rsa.PublicKey{
+		N: fromBase64Int(`
+			oahUIoWw0K0usKNuOR6H4wkf4oBUXHTxRvgb48E-BVvxkeDNjbC4he8rUW
+			cJoZmds2h7M70imEVhRU5djINXtqllXI4DFqcI1DgjT9LewND8MW2Krf3S
+			psk_ZkoFnilakGygTwpZ3uesH-PFABNIUYpOiN15dsQRkgr0vEhxN92i2a
+			sbOenSZeyaxziK72UwxrrKoExv6kc5twXTq4h-QChLOln0_mtUZwfsRaMS
+			tPs6mS6XrgxnxbWhojf663tuEQueGC-FCMfra36C9knDFGzKsNa7LZK2dj
+			YgyD3JR_MB_4NUJW_TqOQtwHYbxevoJArm-L5StowjzGy-_bq6Gw`),
+		E: 65537,
+	}
+
+	expectedCompact := stripWhitespace(`
+		eyJhbGciOiJSU0EtT0FFUCIsImVuYyI6IkEyNTZHQ00ifQ.ROQCfge4JPm_
+		yACxv1C1NSXmwNbL6kvmCuyxBRGpW57DvlwByjyjsb6g8m7wtLMqKEyhFCn
+		tV7sjippEePIlKln6BvVnz5ZLXHNYQgmubuNq8MC0KTwcaGJ_C0z_T8j4PZ
+		a1nfpbhSe-ePYaALrf_nIsSRKu7cWsrwOSlaRPecRnYeDd_ytAxEQWYEKFi
+		Pszc70fP9geZOB_09y9jq0vaOF0jGmpIAmgk71lCcUpSdrhNokTKo5y8MH8
+		3NcbIvmuZ51cjXQj1f0_AwM9RW3oCh2Hu0z0C5l4BujZVsDuGgMsGZsjUhS
+		RZsAQSXHCAmlJ2NlnN60U7y4SPJhKv5tKYw.48V1_ALb6US04U3b.5eym8T
+		W_c8SuK0ltJ3rpYIzOeDQz7TALvtu6UG9oMo4vpzs9tX_EFShS8iB7j6jiS
+		diwkIr3ajwQzaBtQD_A.XFBoMYUZodetZdvTiFvSkQ`)
+
+	expectedFull := stripWhitespace(`
+		{ "protected":"eyJhbGciOiJSU0EtT0FFUCIsImVuYyI6IkEyNTZHQ00ifQ",
+		"encrypted_key":
+			"ROQCfge4JPm_yACxv1C1NSXmwNbL6kvmCuyxBRGpW57DvlwByjyjsb
+			 6g8m7wtLMqKEyhFCntV7sjippEePIlKln6BvVnz5ZLXHNYQgmubuNq
+			 8MC0KTwcaGJ_C0z_T8j4PZa1nfpbhSe-ePYaALrf_nIsSRKu7cWsrw
+			 OSlaRPecRnYeDd_ytAxEQWYEKFiPszc70fP9geZOB_09y9jq0vaOF0
+			 jGmpIAmgk71lCcUpSdrhNokTKo5y8MH83NcbIvmuZ51cjXQj1f0_Aw
+			 M9RW3oCh2Hu0z0C5l4BujZVsDuGgMsGZsjUhSRZsAQSXHCAmlJ2Nln
+			 N60U7y4SPJhKv5tKYw",
+		"iv": "48V1_ALb6US04U3b",
+		"ciphertext":
+			"5eym8TW_c8SuK0ltJ3rpYIzOeDQz7TALvtu6UG9oMo4vpzs9tX_EFS
+			 hS8iB7j6jiSdiwkIr3ajwQzaBtQD_A",
+		"tag":"XFBoMYUZodetZdvTiFvSkQ" }`)
+
+	// Mock random reader
+	RandReader = bytes.NewReader([]byte{
+		// Encryption key
+		177, 161, 244, 128, 84, 143, 225, 115, 63, 180, 3, 255, 107, 154,
+		212, 246, 138, 7, 110, 91, 112, 46, 34, 105, 47, 130, 203, 46, 122,
+		234, 64, 252,
+		// Randomness for RSA-OAEP
+		0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+		// Initialization vector
+		227, 197, 117, 252, 2, 219, 233, 68, 180, 225, 77, 219})
+	defer resetRandReader()
+
+	// Encrypt with a dummy key
+	encrypter, err := NewEncrypter(A256GCM, Recipient{Algorithm: RSA_OAEP, Key: publicKey}, nil)
+	if err != nil {
+		panic(err)
+	}
+
+	object, err := encrypter.Encrypt(plaintext)
+	if err != nil {
+		panic(err)
+	}
+
+	serialized, err := object.CompactSerialize()
+	if serialized != expectedCompact {
+		t.Error("Compact serialization is not what we expected", serialized, expectedCompact)
+	}
+
+	serialized = object.FullSerialize()
+	if serialized != expectedFull {
+		t.Error("Full serialization is not what we expected")
+	}
+}
+
+func TestJWENilProtected(t *testing.T) {
+	key := []byte("1234567890123456")
+	serialized := `{"unprotected":{"alg":"dir","enc":"A128GCM"}}`
+	jwe, _ := ParseEncrypted(serialized)
+	jwe.Decrypt(key)
+}
+
+func TestVectorsJWECorrupt(t *testing.T) {
+	priv := &rsa.PrivateKey{
+		PublicKey: rsa.PublicKey{
+			N: fromHexInt(`
+				a8b3b284af8eb50b387034a860f146c4919f318763cd6c5598c8
+				ae4811a1e0abc4c7e0b082d693a5e7fced675cf4668512772c0c
+				bc64a742c6c630f533c8cc72f62ae833c40bf25842e984bb78bd
+				bf97c0107d55bdb662f5c4e0fab9845cb5148ef7392dd3aaff93
+				ae1e6b667bb3d4247616d4f5ba10d4cfd226de88d39f16fb`),
+			E: 65537,
+		},
+		D: fromHexInt(`
+				53339cfdb79fc8466a655c7316aca85c55fd8f6dd898fdaf1195
+				17ef4f52e8fd8e258df93fee180fa0e4ab29693cd83b152a553d
+				4ac4d1812b8b9fa5af0e7f55fe7304df41570926f3311f15c4d6
+				5a732c483116ee3d3d2d0af3549ad9bf7cbfb78ad884f84d5beb
+				04724dc7369b31def37d0cf539e9cfcdd3de653729ead5d1`),
+		Primes: []*big.Int{
+			fromHexInt(`
+				d32737e7267ffe1341b2d5c0d150a81b586fb3132bed2f8d5262
+				864a9cb9f30af38be448598d413a172efb802c21acf1c11c520c
+				2f26a471dcad212eac7ca39d`),
+			fromHexInt(`
+				cc8853d1d54da630fac004f471f281c7b8982d8224a490edbeb3
+				3d3e3d5cc93c4765703d1dd791642f1f116a0dd852be2419b2af
+				72bfe9a030e860b0288b5d77`),
+		},
+	}
+
+	corruptCiphertext := stripWhitespace(`
+		eyJhbGciOiJSU0EtT0FFUCIsImVuYyI6IkExMjhHQ00ifQ.NFl09dehy
+		IR2Oh5iSsvEa82Ps7DLjRHeo0RnuTuSR45OsaIP6U8yu7vLlWaZKSZMy
+		B2qRBSujf-5XIRoNhtyIyjk81eJRXGa_Bxaor1XBCMyyhGchW2H2P71f
+		PhDO6ufSC7kV4bNqgHR-4ziS7KXwzN83_5kogXqxUpymUoJDNc.tk-GT
+		W_VVhiTIKFF.D_BE6ImZUl9F.52a-zFnRb3YQwIC7UrhVyQ`)
+
+	corruptAuthtag := stripWhitespace(`
+		eyJhbGciOiJSU0EtT0FFUCIsImVuYyI6IkExMjhHQ00ifQ.NFl09dehy
+		IR2Oh5iSsvEa82Ps7DLjRHeo0RnuTuSR45OsaIP6U8yu7vLlWaZKSZMy
+		B2qRBSujf-5XIRoNhtyIyjk81eJRXGa_Bxaor1XBCMyyhGchW2H2P71f
+		PhDO6ufSC7kV4bNqgHR-4ziS7KNwzN83_5kogXqxUpymUoJDNc.tk-GT
+		W_VVhiTIKFF.D_BE6ImZUl9F.52a-zFnRb3YQwiC7UrhVyQ`)
+
+	msg, _ := ParseEncrypted(corruptCiphertext)
+	_, err := msg.Decrypt(priv)
+	if err != ErrCryptoFailure {
+		t.Error("should detect corrupt ciphertext")
+	}
+
+	msg, _ = ParseEncrypted(corruptAuthtag)
+	_, err = msg.Decrypt(priv)
+	if err != ErrCryptoFailure {
+		t.Error("should detect corrupt auth tag")
+	}
+}
+
+// Test vectors generated with nimbus-jose-jwt
+func TestSampleNimbusJWEMessagesRSA(t *testing.T) {
+	rsaPrivateKey, err := x509.ParsePKCS8PrivateKey(fromBase64Bytes(`
+		MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCNRCEmf5PlbXKuT4uwnb
+		wGKvFrtpi+bDYxOZxxqxdVkZM/bYATAnD1fg9pNvLMKeF+MWJ9kPIMmDgOh9RdnRdLvQGb
+		BzhLmxwhhcua2QYiHEZizXmiaXvNP12bzEBhebdX7ObW8izMVW0p0lqHPNzkK3K75B0Sxo
+		FMVKkZ7KtBHgepBT5yPhPPcNe5lXQeTne5bo3I60DRcN9jTBgMJOXdq0I9o4y6ZmoXdNTm
+		0EyLzn9/EYiHqBxtKFh791EHR7wYgyi/t+nOKr4sO74NbEByP0mHDil+mPvZSzFW4l7fPx
+		OclRZvpRIKIub2TroZA9s2WsshGf79eqqXYbBB9NNRAgMBAAECggEAIExbZ/nzTplfhwsY
+		3SCzRJW87OuqsJ79JPQPGM4NX7sQ94eJqM7+FKLl0yCFErjgnYGdCyiArvB+oJPdsimgke
+		h83X0hGeg03lVA3/6OsG3WifCAxulnLN44AM8KST8S9D9t5+cm5vEBLHazzAfWWTS13s+g
+		9hH8rf8NSqgZ36EutjKlvLdHx1mWcKX7SREFVHT8FWPAbdhTLEHUjoWHrfSektnczaSHnt
+		q8fFJy6Ld13QkF1ZJRUhtA24XrD+qLTc+M36IuedjeZaLHFB+KyhYR3YvXEtrbCug7dCRd
+		uG6uTlDCSaSy7xHeTPolWtWo9F202jal54otxiAJFGUHgQKBgQDRAT0s6YQZUfwE0wluXV
+		k0JdhDdCo8sC1aMmKlRKWUkBAqrDl7BI3MF56VOr4ybr90buuscshFf9TtrtBOjHSGcfDI
+		tSKfhhkW5ewQKB0YqyHzoD6UKT0/XAshFY3esc3uCxuJ/6vOiXV0og9o7eFvr51O0TfDFh
+		mcTvW4wirKlQKBgQCtB7UAu8I9Nn8czkd6oXLDRyTWYviuiqFmxR+PM9klgZtsumkeSxO1
+		lkfFoj9+G8nFaqYEBA9sPeNtJVTSROCvj/iQtoqpV2NiI/wWeVszpBwsswx2mlks4LJa8a
+		Yz9xrsfNoroKYVppefc/MCoSx4M+99RSm3FSpLGZQHAUGyzQKBgQDMQmq4JuuMF1y2lk0E
+		SESyuz21BqV0tDVOjilsHT+5hmXWXoS6nkO6L2czrrpM7YE82F6JJZBmo7zEIXHBInGLJ3
+		XLoYLZ5qNEhqYDUEDHaBCBWZ1vDTKnZlwWFEuXVavNNZvPbUhKTHq25t8qjDki/r09Vykp
+		BsM2yNBKpbBOVQKBgCJyUVd3CaFUExQyAMrqD0XPCQdhJq7gzGcAQVsp8EXmOoH3zmuIeM
+		ECzQEMXuWFNLMHm0tbX5Kl83vMHcnKioyI9ewhWxOBYTitf0ceG8j5F97SOl32NmCXzwoJ
+		55Oa0xJXfLuIvOe8hZzp4WwZmBfKBxiCR166aPQQgIawelrVAoGAEJsHomfCI4epxH4oMw
+		qYJMCGy95zloB+2+c86BZCOJAGwnfzbtc2eutWZw61/9sSO8sQCfzA8oX+5HwAgnFVzwW4
+		lNMZohppYcpwN9EyjkPaCXuALC7p5rF2o63wY7JLvnjS2aYZliknh2yW6X6fSB0PK0Cpvd
+		lAIyRw6Kud0zI=`))
+	if err != nil {
+		panic(err)
+	}
+
+	rsaSampleMessages := []string{
+		"eyJlbmMiOiJBMTI4R0NNIiwiYWxnIjoiUlNBMV81In0.EW0KOhHeoAxTBnLjYhh2T6HjwI-srNs6RpcSdZvE-GJ5iww3EYWBCmeGGj1UVz6OcBfwW3wllZ6GPOHU-hxVQH5KYpVOjkmrFIYU6-8BHhxBP_PjSJEBCZzjOgsCm9Th4-zmlO7UWTdK_UtwE7nk4X-kkmEy-aZBCShA8nFe2MVvqD5F7nvEWNFBOHh8ae_juo-kvycoIzvxLV9g1B0Zn8K9FAlu8YF1KiL5NFekn76f3jvAwlExuRbFPUx4gJN6CeBDK_D57ABsY2aBVDSiQceuYZxvCIAajqSS6dMT382FNJzAiQhToOpo_1w5FnnBjzJLLEKDk_I-Eo2YCWxxsQ.5mCMuxJqLRuPXGAr.Ghe4INeBhP3MDWGvyNko7qanKdZIzKjfeiU.ja3UlVWJXKNFJ-rZsJWycw",
+		"eyJlbmMiOiJBMTkyR0NNIiwiYWxnIjoiUlNBMV81In0.JsJeYoP0St1bRYNUaAmA34DAA27usE7RNuC2grGikBRmh1xrwUOpnEIXXpwr7fjVmNi52zzWkNHC8JkkRTrLcCh2VXvnOnarpH8DCr9qM6440bSrahzbxIvDds8z8q0wT1W4kjVnq1mGwGxg8RQNBWTV6Sp2FLQkZyjzt_aXsgYzr3zEmLZxB-d41lBS81Mguk_hdFJIg_WO4ao54lozvxkCn_uMiIZ8eLb8qHy0h-N21tiHGCaiC2vV8KXomwoqbJ0SXrEH4r9_R2J844H80TBZdbvNBd8whvoQNHvOX659LNs9EQ9xxvHU2kqGZekXBu7sDXXTjctMkMITobGSzw.1v5govaDvanP3LGp.llwYNBDrD7MwVLaFHesljlratfmndWs4XPQ.ZGT1zk9_yIKi2GzW6CuAyA",
+		"eyJlbmMiOiJBMjU2R0NNIiwiYWxnIjoiUlNBMV81In0.fBv3fA3TMS3ML8vlsCuvwdsKvB0ym8R30jJrlOiqkWKk7WVUkjDInFzr1zw3Owla6c5BqOJNoACXt4IWbkLbkoWV3tweXlWwpafuaWPkjLOUH_K31rS2fCX5x-MTj8_hScquVQXpbz3vk2EfulRmGXZc_8JU2NqQCAsYy3a28houqP3rDe5jEAvZS2SOFvJkKW--f5S-z39t1D7fNz1N8Btd9SmXWQzjbul5YNxI9ctqxhJpkKYpxOLlvrzdA6YdJjOlDx3n6S-HnSZGM6kQd_xKtAf8l1EGwhQmhbXhMhjVxMvGwE5BX7PAb8Ccde5bzOCJx-PVbVetuLb169ZYqQ._jiZbOPRR82FEWMZ.88j68LI-K2KT6FMBEdlz6amG5nvaJU8a-90.EnEbUTJsWNqJYKzfO0x4Yw",
+		"eyJlbmMiOiJBMTI4Q0JDLUhTMjU2IiwiYWxnIjoiUlNBMV81In0.bN6FN0qmGxhkESiVukrCaDVG3woL0xE-0bHN_Mu0WZXTQWbzzT-7jOvaN1xhGK8nzi8qpCSRgE5onONNB9i8OnJm3MMIxF7bUUEAXO9SUAFn2v--wNc4drPc5OjIu0RiJrDVDkkGjNrBDIuBaEQcke7A0v91PH58dXE7o4TLPzC8UJmRtXWhUSwjXVF3-UmYRMht2rjHJlvRbtm6Tu2LMBIopRL0zj6tlPP4Dm7I7sz9OEB3VahYAhpXnFR7D_f8RjLSXQmBvB1FiI5l_vMz2NFt2hYUmQF3EJMLIEdHvvPp3iHDGiXC1obJrDID_CCf3qs9UY7DMYL622KLvP2NIg.qb72oxECzxd_aNuHVR0aNg.Gwet9Ms8hB8rKEb0h4RGdFNRq97Qs2LQaJM0HWrCqoI.03ljVThOFvgXzMmQJ79VjQ",
+		"eyJlbmMiOiJBMTkyQ0JDLUhTMzg0IiwiYWxnIjoiUlNBMV81In0.ZbEOP6rqdiIP4g7Nl1PL5gwhgDwv9RinyiUQxZXPOmD7kwEZrZ093dJnhqI9kEd3QGFlHDpB7HgNz53d27z2zmEj1-27v6miizq6tH4sN2MoeZLwSyk16O1_n3bVdDmROawsTYYFJfHsuLwyVJxPd37duIYnbUCFO9J8lLIv-2VI50KJ1t47YfE4P-Wt9jVzxP2CVUQaJwTlcwfiDLJTagYmfyrDjf525WlQFlgfJGqsJKp8BX9gmKvAo-1iCBAM8VpEjS0u0_hW9VSye36yh8BthVV-VJkhJ-0tMpto3bbBmj7M25Xf4gbTrrVU7Nz6wb18YZuhHZWmj2Y2nHV6Jg.AjnS44blTrIIfFlqVw0_Mg.muCRgaEXNKKpW8rMfW7jf7Zpn3VwSYDz-JTRg16jZxY.qjc9OGlMaaWKDWQSIwVpR4K556Pp6SF9",
+		"eyJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYWxnIjoiUlNBMV81In0.c7_F1lMlRHQQE3WbKmtHBYTosdZrG9hPfs-F9gNQYet61zKG8NXVkSy0Zf2UFHt0vhcO8hP2qrqOFsy7vmRj20xnGHQ2EE29HH6hwX5bx1Jj3uE5WT9Gvh0OewpvF9VubbwWTIObBpdEG7XdJsMAQlIxtXUmQYAtLTWcy2ZJipyJtVlWQLaPuE8BKfZH-XAsp2CpQNiRPI8Ftza3EAspiyRfVQbjKt7nF8nuZ2sESjt7Y50q4CSiiCuGT28T3diMN0_rWrH-I-xx7OQvJlrQaNGglGtu3jKUcrJDcvxW2e1OxriaTeuQ848ayuRvGUNeSv6WoVYmkiK1x_gNwUAAbw.7XtSqHJA7kjt6JrfxJMwiA.Yvi4qukAbdT-k-Fd2s4G8xzL4VFxaFC0ZIzgFDAI6n0.JSWPJ-HjOE3SK9Lm0yHclmjS7Z1ahtQga9FHGCWVRcc",
+		"eyJlbmMiOiJBMTI4R0NNIiwiYWxnIjoiUlNBLU9BRVAifQ.SYVxJbCnJ_tcR13LJpaqHQj-nGNkMxre4A1FmnUdxnvzeJwuvyrLiUdRsZR1IkP4fqLtDON2mumx39QeJQf0WIObPBYlIxycRLkwxDHRVlyTmPvdZHAxN26jPrk09wa5SgK1UF1W1VSQIPm-Tek8jNAmarF1Yxzxl-t54wZFlQiHP4TuaczugO5f-J4nlWenfla2mU1snDgdUMlEZGOAQ_gTEtwSgd1MqXmK_7LZBkoDqqoCujMZhziafJPXPDaUUqBLW3hHkkDA7GpVec3XcTtNUWQJqOpMyQhqo1KQMc8jg3fuirILp-hjvvNVtBnCRBvbrKUCPzu2_yH3HM_agA.2VsdijtonAxShNIW.QzzB3P9CxYP3foNKN0Ma1Z9tMwijAlkWo08.ZdQkIPDY_M-hxqi5fD4NGw",
+		"eyJlbmMiOiJBMTkyR0NNIiwiYWxnIjoiUlNBLU9BRVAifQ.Z2oTJXXib1u-S38Vn3DRKE3JnhnwgUa92UhsefzY2Wpdn0dmxMfYt9iRoJGFfSAcA97MOfjyvXVRCKWXGrG5AZCMAXEqU8SNQwKPRjlcqojcVzQyMucXI0ikLC4mUgeRlfKTwsBicq6JZZylzRoLGGSNJQbni3_BLsf7H3Qor0BYg0FPCLG9Z2OVvrFzvjTLmZtV6gFlVrMHBxJub_aUet9gAkxiu1Wx_Kx46TlLX2tkumXIpTGlzX6pef6jLeZ5EIg_K-Uz4tkWgWQIEkLD7qmTyk5pAGmzukHa_08jIh5-U-Sd8XGZdx4J1pVPJ5CPg0qDJGZ_cfgkgpWbP_wB6A.4qgKfokK1EwYxz20._Md82bv_KH2Vru0Ue2Eb6oAqHP2xBBP5jF8.WFRojvQpD5VmZlOr_dN0rQ",
+		"eyJlbmMiOiJBMjU2R0NNIiwiYWxnIjoiUlNBLU9BRVAifQ.JzCUgJcBJmBgByp4PBAABUfhezPvndxBIVzaoZ96DAS0HPni0OjMbsOGsz6JwNsiTr1gSn_S6R1WpZM8GJc9R2z0EKKVP67TR62ZSG0MEWyLpHmG_4ug0fAp1HWWMa9bT4ApSaOLgwlpVAb_-BPZZgIu6c8cREuMon6UBHDqW1euTBbzk8zix3-FTZ6p5b_3soDL1wXfRiRBEsxxUGMnpryx1OFb8Od0JdyGF0GgfLt6OoaujDJpo-XtLRawu1Xlg6GqRs0NQwSHZ5jXgQ6-zgCufXonAmYTiIyBXY2no9XmECTexjwrS_05nA7H-UyIZEBOCp3Yhz2zxrt5j_0pvQ.SJR-ghhaUKP4zXtZ.muiuzLfZA0y0BDNsroGTw2r2-l73SLf9lK8.XFMH1oHr1G6ByP3dWSUUPA",
+		"eyJlbmMiOiJBMTI4Q0JDLUhTMjU2IiwiYWxnIjoiUlNBLU9BRVAifQ.U946MVfIm4Dpk_86HrnIA-QXyiUu0LZ67PL93CMLmEtJemMNDqmRd9fXyenCIhAC7jPIV1aaqW7gS194xyrrnUpBoJBdbegiPqOfquy493Iq_GQ8OXnFxFibPNQ6rU0l8BwIfh28ei_VIF2jqN6bhxFURCVW7fG6n6zkCCuEyc7IcxWafSHjH2FNttREuVj-jS-4LYDZsFzSKbpqoYF6mHt8H3btNEZDTSmy_6v0fV1foNtUKNfWopCp-iE4hNh4EzJfDuU8eXLhDb03aoOockrUiUCh-E0tQx9su4rOv-mDEOHHAQK7swm5etxoa7__9PC3Hg97_p4GM9gC9ykNgw.pnXwvoSPi0kMQP54of-HGg.RPJt1CMWs1nyotx1fOIfZ8760mYQ69HlyDp3XmdVsZ8.Yxw2iPVWaBROFE_FGbvodA",
+		"eyJlbmMiOiJBMTkyQ0JDLUhTMzg0IiwiYWxnIjoiUlNBLU9BRVAifQ.eKEOIJUJpXmO_ghH_nGCJmoEspqKyiy3D5l0P8lKutlo8AuYHPQlgOsaFYnDkypyUVWd9zi-JaQuCeo7dzoBiS1L71nAZo-SUoN0anQBkVuyuRjr-deJMhPPfq1H86tTk-4rKzPr1Ivd2RGXMtWsrUpNGk81r1v8DdMntLE7UxZQqT34ONuZg1IXnD_U6di7k07unI29zuU1ySeUr6w1YPw5aUDErMlpZcEJWrgOEYWaS2nuC8sWGlPGYEjqkACMFGn-y40UoS_JatNZO6gHK3SKZnXD7vN5NAaMo_mFNbh50e1t_zO8DaUdLtXPOBLcx_ULoteNd9H8HyDGWqwAPw.0xmtzJfeVMoIT1Cp68QrXA.841l1aA4c3uvSYfw6l180gn5JZQjL53WQ5fr8ejtvoI.lojzeWql_3gDq-AoaIbl_aGQRH_54w_f",
+		"eyJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYWxnIjoiUlNBLU9BRVAifQ.D0QkvIXR1TL7dIHWuPNMybmmD8UPyQd1bRKjRDNbA2HmKGpamCtcJmpNB_EetNFe-LDmhe44BYI_XN2wIBbYURKgDK_WG9BH0LQw_nCVqQ-sKqjtj3yQeytXhLHYTDmiF0TO-uW-RFR7GbPAdARBfuf4zj82r_wDD9sD5WSCGx89iPfozDOYQ_OLwdL2WD99VvDyfwS3ZhxA-9IMSYv5pwqPkxj4C0JdjCqrN0YNrZn_1ORgjtsVmcWXsmusObTozUGA7n5GeVepfZdU1vrMulAwdRYqOYtlqKaOpFowe9xFN3ncBG7wb4f9pmzbS_Dgt-1_Ii_4SEB9GQ4NiuBZ0w.N4AZeCxMGUv52A0UVJsaZw.5eHOGbZdtahnp3l_PDY-YojYib4ft4SRmdsQ2kggrTs.WsmGH8ZDv4ctBFs7qsQvw2obe4dVToRcAQaZ3PYL34E",
+		"eyJlbmMiOiJBMTI4R0NNIiwiYWxnIjoiUlNBLU9BRVAtMjU2In0.fDTxO_ZzZ3Jdrdw-bxvg7u-xWB2q1tp3kI5zH6JfhLUm4h6rt9qDA_wZlRym8-GzEtkUjkTtQGs6HgQx_qlyy8ylCakY5GHsNhCG4m0UNhRiNfcasAs03JSXfON9-tfTJimWD9n4k5OHHhvcrsCW1G3jYeLsK9WHCGRIhNz5ULbo8HBrCTbmZ6bOEQ9mqhdssLpdV24HDpebotf3bgPJqoaTfWU6Uy7tLmPiNuuNRLQ-iTpLyNMTVvGqqZhpcV3lAEN5l77QabI5xLJYucvYjrXQhAEZ7YXO8oRYhGkdG2XXIRcwr87rBeRH-47HAyhZgF_PBPBhhrJNS9UNMqdfBw.FvU4_s7Md6vxnXWd.fw29Q4_gHt4f026DPPV-CNebQ8plJ6IVLX8._apBZrw7WsT8HOmxgCrTwA",
+		"eyJlbmMiOiJBMTkyR0NNIiwiYWxnIjoiUlNBLU9BRVAtMjU2In0.bYuorK-rHMbO4c2CRWtvyOEaM1EN-o-wLRZ0wFWRX9mCXQ-iTNarZn7ksYM1XnGmZ4u3CSowX1Hpca9Rg72_VJCmKapqCT7r3YfasN4_oeLwuSKI_gT-uVOznod97tn3Gf_EDv0y1V4H0k9BEIFGbajAcG1znTD_ODY3j2KZJxisfrsBoslc6N-HI0kKZMC2hSGuHOcOf8HN1sTE-BLqZCtoj-zxQECJK8Wh14Ih4jzzdmmiu_qmSR780K6su-4PRt3j8uY7oCiLBfwpCsCmhJgp8rKd91zoedZmamfvX38mJIfE52j4fG6HmIYw9Ov814fk9OffV6tzixjcg54Q2g.yeVJz4aSh2s-GUr9.TBzzWP5llEiDdugpP2SmPf2U4MEGG9EoPWk.g25UoWpsBaOd45J__FX7mA",
+		"eyJlbmMiOiJBMjU2R0NNIiwiYWxnIjoiUlNBLU9BRVAtMjU2In0.h9tFtmh762JuffBxlSQbJujCyI4Zs9yc3IOb1yR8g65W4ZHosIvzVGHWbShj4EY9MNrz-RbKtHfqQGGzDeo3Xb4-HcQ2ZDHyWoUg7VfA8JafJ5zIKL1npz8eUExOVMLsAaRfHg8qNfczodg3egoSmX5Q-nrx4DeidDSXYZaZjV0C72stLTPcuQ7XPV7z1tvERAkqpvcsRmJn_PiRNxIbAgoyHMJ4Gijuzt1bWZwezlxYmw0TEuwCTVC2fl9NJTZyxOntS1Lcm-WQGlPkVYeVgYTOQXLlp7tF9t-aAvYpth2oWGT6Y-hbPrjx_19WaKD0XyWCR46V32DlXEVDP3Xl2A.NUgfnzQyEaJjzt9r.k2To43B2YVWMeR-w3n4Pr2b5wYq2o87giHk.X8_QYCg0IGnn1pJqe8p_KA",
+		"eyJlbmMiOiJBMTI4Q0JDLUhTMjU2IiwiYWxnIjoiUlNBLU9BRVAtMjU2In0.EDq6cNP6Yp1sds5HZ4CkXYp7bs9plIYVZScKvuyxUy0H1VyBC_YWg0HvndPNb-vwh1LA6KMxRazlOwJ9iPR9YzHnYmGgPM3Je_ZzBfiPlRfq6hQBpGnNaypBI1XZ2tyFBhulsVLqyJe2SmM2Ud00kasOdMYgcN8FNFzq7IOE7E0FUQkIwLdUL1nrzepiYDp-5bGkxWRcL02cYfdqdm00G4m0GkUxAmdxa3oPNxZlt2NeBI_UVWQSgJE-DJVJQkDcyA0id27TV2RCDnmujYauNT_wYlyb0bFDx3pYzzNXfAXd4wHZxt75QaLZ5APJ0EVfiXJ0qki6kT-GRVmOimUbQA.vTULZL7LvS0WD8kR8ZUtLg.mb2f0StEmmkuuvsyz8UplMvF58FtZzlu8eEwzvPUvN0.hbhveEN40V-pgG2hSVgyKg",
+		"eyJlbmMiOiJBMTkyQ0JDLUhTMzg0IiwiYWxnIjoiUlNBLU9BRVAtMjU2In0.DuYk92p7u-YIN-JKn-XThmlVcnhU9x5TieQ2uhsLQVNlo0iWC9JJPP6bT6aI6u_1BIS3yE8_tSGGL7eM-zyEk6LuTqSWFRaZcZC06d0MnS9eYZcw1T2D17fL-ki-NtCaTahJD7jE2s0HevRVW49YtL-_V8whnO_EyVjvXIAQlPYqhH_o-0Nzcpng9ggdAnuF2rY1_6iRPYFJ3BLQvG1oWhyJ9s6SBttlOa0i6mmFCVLHx6sRpdGAB3lbCL3wfmHq4tpIv77gfoYUNP0SNff-zNmBXF_wp3dCntLZFTjbfMpGyHlruF_uoaLqwdjYpUGNUFVUoeSiMnSbMKm9NxiDgQ.6Mdgcqz7bMU1UeoAwFC8pg.W36QWOlBaJezakUX5FMZzbAgeAu_R14AYKZCQmuhguw.5OeyIJ03olxmJft8uBmjuOFQPWNZMYLI",
+		"eyJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYWxnIjoiUlNBLU9BRVAtMjU2In0.ECulJArWFsPL2FlpCN0W8E7IseSjJg1cZqE3wz5jk9gvwgNForAUEv5KYZqhNI-p5IxkGV0f8K6Y2X8pWzbLwiPIjZe8_dVqHYJoINxqCSgWLBhz0V36qL9Nc_xARTBk4-ZteIu75NoXVeos9gNvFnkOCj4tm-jGo8z8EFO9XfODgjhiR4xv8VqUtvrkjo9GQConaga5zpV-J4JQlXbdqbDjnuwacnJAxYpFyuemqcgqsl6BnFX3tovGkmSUPqcvF1A6tiHqr-TEmcgVqo5C3xswknRBKTQRM00iAmJ92WlVdkoOCx6E6O7cVHFawZ14BLzWzm66Crb4tv0ucYvk_Q.mxolwUaoj5S5kHCfph0w8g.nFpgYdnYg3blHCCEi2XXQGkkKQBXs2OkZaH11m3PRvk.k8BAVT4EcyrUFVIKr-KOSPbF89xyL0Vri2rFTu2iIWM",
+	}
+
+	for _, msg := range rsaSampleMessages {
+		obj, err := ParseEncrypted(msg)
+		if err != nil {
+			t.Error("unable to parse message", msg, err)
+			continue
+		}
+		plaintext, err := obj.Decrypt(rsaPrivateKey)
+		if err != nil {
+			t.Error("unable to decrypt message", msg, err)
+			continue
+		}
+		if string(plaintext) != "Lorem ipsum dolor sit amet" {
+			t.Error("plaintext is not what we expected for msg", msg)
+		}
+	}
+}
+
+// Test vectors generated with nimbus-jose-jwt
+func TestSampleNimbusJWEMessagesAESKW(t *testing.T) {
+	aesTestKeys := [][]byte{
+		fromHexBytes("DF1FA4F36FFA7FC42C81D4B3C033928D"),
+		fromHexBytes("DF1FA4F36FFA7FC42C81D4B3C033928D95EC9CDC2D82233C"),
+		fromHexBytes("DF1FA4F36FFA7FC42C81D4B3C033928D95EC9CDC2D82233C333C35BA29044E90"),
+	}
+
+	aesSampleMessages := [][]string{
+		{
+			"eyJ6aXAiOiJERUYiLCJlbmMiOiJBMTI4R0NNIiwidGFnIjoib2ZMd2Q5NGloVWFRckJ0T1pQUDdjUSIsImFsZyI6IkExMjhHQ01LVyIsIml2IjoiV2Z3TnN5cjEwWUFjY2p2diJ9.9x3RxdqIS6P9xjh93Eu1bQ.6fs3_fSGt2jull_5.YDlzr6sWACkFg_GU5MEc-ZEWxNLwI_JMKe_jFA.f-pq-V7rlSSg_q2e1gDygw",
+			"eyJ6aXAiOiJERUYiLCJlbmMiOiJBMTkyR0NNIiwidGFnIjoic2RneXB1ckFjTEFzTmZJU0lkZUNpUSIsImFsZyI6IkExMjhHQ01LVyIsIml2IjoieVFMR0dCdDJFZ0c1THdyViJ9.arslKo4aKlh6f4s0z1_-U-8JbmhAoZHN.Xw2Q-GX98YXwuc4i.halTEWMWAYZbv-qOD52G6bte4x6sxlh1_VpGEA.Z1spn016v58cW6Q2o0Qxag",
+			"eyJ6aXAiOiJERUYiLCJlbmMiOiJBMjU2R0NNIiwidGFnIjoicTNzejF5VUlhbVBDYXJfZ05kSVJqQSIsImFsZyI6IkExMjhHQ01LVyIsIml2IjoiM0ZRM0FsLWJWdWhmcEIyQyJ9.dhVipWbzIdsINttuZM4hnjpHvwEHf0VsVrOp4GAg01g.dk7dUyt1Qj13Pipw.5Tt70ONATF0BZAS8dBkYmCV7AQUrfb8qmKNLmw.A6ton9MQjZg0b3C0QcW-hg",
+			"eyJ6aXAiOiJERUYiLCJlbmMiOiJBMTI4Q0JDLUhTMjU2IiwidGFnIjoiUHNpTGphZnJZNE16UlRmNlBPLTZfdyIsImFsZyI6IkExMjhHQ01LVyIsIml2IjoiSUFPbnd2ODR5YXFEaUxtbSJ9.swf92_LyCvjsvkynHTuMNXRl_MX2keU-fMDWIMezHG4.LOp9SVIXzs4yTnOtMyXZYQ.HUlXrzqJ1qXYl3vUA-ydezCg77WvJNtKdmZ3FPABoZw.8UYl1LOofQLAxHHvWqoTbg",
+			"eyJ6aXAiOiJERUYiLCJlbmMiOiJBMTkyQ0JDLUhTMzg0IiwidGFnIjoiWGRndHQ5dUVEMVlVeU1rVHl6M3lqZyIsImFsZyI6IkExMjhHQ01LVyIsIml2IjoiWF90V2RhSmh6X3J1SHJvQSJ9.JQ3dS1JSgzIFi5M9ig63FoFU1nHBTmPwXY_ovNE2m1JOSUvHtalmihIuraPDloCf.e920JVryUIWt7zJJQM-www.8DUrl4LmsxIEhRr9RLTHG9tBTOcwXqEbQHAJd_qMHzE.wHinoqGUhL4O7lx125kponpwNtlp8VGJ",
+			"eyJ6aXAiOiJERUYiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwidGFnIjoicGgyaTdoY0FWNlh3ZkQta1RHYlVXdyIsImFsZyI6IkExMjhHQ01LVyIsIml2IjoiaG41Smk4Wm1rUmRrSUxWVSJ9._bQlJXl22dhsBgYPhkxUyinBNi871teGWbviOueWj2PqG9OPxIc9SDS8a27YLSVDMircd5Q1Df28--vcXIABQA.DssmhrAg6w_f2VDaPpxTbQ.OGclEmqrxwvZqAfn7EgXlIfXgr0wiGvEbZz3zADnqJs.YZeP0uKVEiDl8VyC-s20YN-RbdyGNsbdtoGDP3eMof8",
+			"eyJ6aXAiOiJERUYiLCJlbmMiOiJBMTI4R0NNIiwiYWxnIjoiQTEyOEtXIn0.TEMcXEoY8WyqGjYs5GZgS-M_Niwu6wDY.i-26KtTt51Td6Iwd.wvhkagvPsLj3QxhPBbfH_th8OqxisUtme2UadQ.vlfvBPv3bw2Zk2H60JVNLQ",
+			"eyJ6aXAiOiJERUYiLCJlbmMiOiJBMTkyR0NNIiwiYWxnIjoiQTEyOEtXIn0.gPaR6mgQ9TUx05V6DRfgTQeZxl0ZSzBa5uQd-qw6yLs.MojplOD77FkMooS-.2yuD7dKR_C3sFbhgwiBccKKOF8DrSvNiwX7wPQ.qDKUbSvMnJv0qifjpWC14g",
+			"eyJ6aXAiOiJERUYiLCJlbmMiOiJBMjU2R0NNIiwiYWxnIjoiQTEyOEtXIn0.Fg-dgSkUW1KEaL5YDPoWHNL8fpX1WxWVLA9OOWsjIFhQVDKyUZI7BQ.mjRBpyJTZf7H-quf.YlNHezMadtaSKp23G-ozmYhHOeHwuJnvWGTtGg.YagnR7awBItUlMDo4uklvg",
+			"eyJ6aXAiOiJERUYiLCJlbmMiOiJBMTI4Q0JDLUhTMjU2IiwiYWxnIjoiQTEyOEtXIn0.x1vYzUE-E2XBWva9OPuwtqfQaf9rlJCIBAyAe6N2q2kWfJrkxGxFsQ.gAwe78dyODFaoP2IOityAA.Yh5YfovkWxGBNAs1sVhvXow_2izHHsBiYEc9JYD6kVg.mio1p3ncp2wLEaEaRa7P0w",
+			"eyJ6aXAiOiJERUYiLCJlbmMiOiJBMTkyQ0JDLUhTMzg0IiwiYWxnIjoiQTEyOEtXIn0.szGrdnmF7D5put2aRBvSSFfp0vRgkRGYaafijJIqAF6PWd1IxsysZRV8aQkQOW1cB6d0fXsTfYM.Ru25LVOOk4xhaK-cIZ0ThA.pF9Ok5zot7elVqXFW5YYHV8MuF9gVGzpQnG1XDs_g_w.-7la0uwcNPpteev185pMHZjbVDXlrec8",
+			"eyJ6aXAiOiJERUYiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYWxnIjoiQTEyOEtXIn0.cz-hRv0xR5CnOcnoRWNK8Q9poyVYzRCVTjfmEXQN6xPOZUkJ3zKNqb8Pir_FS0o2TVvxmIbuxeISeATTR2Ttx_YGCNgMkc93.SF5rEQT94lZR-UORcMKqGw.xphygoU7zE0ZggOczXCi_ytt-Evln8CL-7WLDlWcUHg.5h99r8xCCwP2PgDbZqzCJ13oFfB2vZWetD5qZjmmVho",
+		},
+		{
+			"eyJ6aXAiOiJERUYiLCJlbmMiOiJBMTI4R0NNIiwidGFnIjoiVWR5WUVKdEJ5ZTA5dzdjclY0cXI1QSIsImFsZyI6IkExOTJHQ01LVyIsIml2IjoiZlBBV0QwUmdSbHlFdktQcCJ9.P1uTfTuH-imL-NJJMpuTRA.22yqZ1NIfx3KNPgc.hORWZaTSgni1FS-JT90vJly-cU37qTn-tWSqTg.gMN0ufXF92rSXupTtBNkhA",
+			"eyJ6aXAiOiJERUYiLCJlbmMiOiJBMTkyR0NNIiwidGFnIjoiOU9qX3B2LTJSNW5lZl9YbWVkUWltUSIsImFsZyI6IkExOTJHQ01LVyIsIml2IjoiY3BybGEwYUYzREVQNmFJTSJ9.6NVpAm_APiC7km2v-oNR8g23K9U_kf1-.jIg-p8tNwSvwxch0.1i-GPaxS4qR6Gy4tzeVtSdRFRSKQSMpmn-VhzA.qhFWPqtA6vVPl7OM3DThsA",
+			"eyJ6aXAiOiJERUYiLCJlbmMiOiJBMjU2R0NNIiwidGFnIjoiOVc3THg3MVhGQVJCb3NaLVZ5dXc4ZyIsImFsZyI6IkExOTJHQ01LVyIsIml2IjoiZ1N4ZE5heFdBSVBRR0tHYiJ9.3YjPz6dVQwAtCekvtXiHZrooOUlmCsMSvyfwmGwdrOA.hA_C0IDJmGaRzsB0.W4l7OPqpFxiVOZTGfAlRktquyRTo4cEOk9KurQ.l4bGxOkO_ql_jlPo3Oz3TQ",
+			"eyJ6aXAiOiJERUYiLCJlbmMiOiJBMTI4Q0JDLUhTMjU2IiwidGFnIjoiOHJYbWl2WXFWZjNfbHhhd2NUbHJoUSIsImFsZyI6IkExOTJHQ01LVyIsIml2IjoiVXBWeXprVTNKcjEwYXRqYyJ9.8qft-Q_xqUbo5j_aVrVNHchooeLttR4Kb6j01O8k98M.hXO-5IKBYCL9UdwBFVm0tg.EBM4lCZX_K6tfqYmfoDxVPHcf6cT--AegXTTjfSqsIw.Of8xUvEQSh3xgFT3uENnAg",
+			"eyJ6aXAiOiJERUYiLCJlbmMiOiJBMTkyQ0JDLUhTMzg0IiwidGFnIjoiVnItSnVaX0tqV2hSWWMzdzFwZ3cwdyIsImFsZyI6IkExOTJHQ01LVyIsIml2IjoiRGg2R3dISVBVS3ljZGNZeCJ9.YSEDjCnGWr_n9H94AvLoRnwm6bdU9w6-Q67k-QQRVcKRd6673pgH9zEF9A9Dt6o1.gcmVN4kxqBuMq6c7GrK3UQ.vWzJb0He6OY1lhYYjYS7CLh55REAAq1O7yNN-ND4R5Q.OD0B6nwyFaDr_92ysDOtlVnJaeoIqhGw",
+			"eyJ6aXAiOiJERUYiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwidGFnIjoieEtad1BGYURpQ3NqUnBqZUprZHhmZyIsImFsZyI6IkExOTJHQ01LVyIsIml2IjoieTVHRFdteXdkb2R1SDJlYyJ9.AW0gbhWqlptOQ1y9aoNVwrTIIkBfrp33C2OWJsbrDRk6lhxg_IgFhMDTE37moReySGUtttC4CXQD_7etHmd3Hw.OvKXK-aRKlXHOpJQ9ZY_YQ.Ngv7WarDDvR2uBj_DavPAR3DYuIaygvSSdcHrc8-ZqM.MJ6ElitzFCKf_0h5fIJw8uOLC6ps7dKZPozF8juQmUY",
+			"eyJ6aXAiOiJERUYiLCJlbmMiOiJBMTI4R0NNIiwiYWxnIjoiQTE5MktXIn0.8qu63pppcSvp1vv37WrZ44qcCTg7dQMA.cDp-f8dJTrDEpZW4.H6OBJYs4UvFR_IZHLYQZxB6u9a0wOdAif2LNfQ.1dB-id0UIwRSlmwHx5BJCg",
+			"eyJ6aXAiOiJERUYiLCJlbmMiOiJBMTkyR0NNIiwiYWxnIjoiQTE5MktXIn0._FdoKQvC8qUs7K0upriEihUwztK8gOwonXpOxdIwrfs.UO38ok8gDdpLVa1T.x1GvHdVCy4fxoQRg-OQK4Ez3jDOvu9gllLPeEA.3dLeZGIprh_nHizOTVi1xw",
+			"eyJ6aXAiOiJERUYiLCJlbmMiOiJBMjU2R0NNIiwiYWxnIjoiQTE5MktXIn0.uzCJskgSIK6VkjJIu-dQi18biqaY0INc_A1Ehx0oESafgtR99_n4IA.W2eKK8Y14WwTowI_.J2cJC7R6Bz6maR0s1UBMPyRi5BebNUAmof4pvw.-7w6htAlc4iUsOJ6I04rFg",
+			"eyJ6aXAiOiJERUYiLCJlbmMiOiJBMTI4Q0JDLUhTMjU2IiwiYWxnIjoiQTE5MktXIn0.gImQeQETp_6dfJypFDPLlv7c5pCzuq86U16gzrLiCXth6X9XfxJpvQ.YlC4MxjtLWrsyEvlFhvsqw.Vlpvmg9F3gkz4e1xG01Yl2RXx-jG99rF5UvCxOBXSLc.RZUrU_FoR5bG3M-j3GY0Dw",
+			"eyJ6aXAiOiJERUYiLCJlbmMiOiJBMTkyQ0JDLUhTMzg0IiwiYWxnIjoiQTE5MktXIn0.T2EfQ6Tu2wJyRMgZzfvBYmQNCCfdMudMrg86ibEMVAOUKJPtR3WMPEb_Syy9p2VjrLKRlv7nebo.GPc8VbarPPRtzIRATB8NsA.ugPCqLvVLwh55bWlwjsFkmWzJ31z5z-wuih2oJqmG_U.m7FY3EjvV6mKosEYJ5cY7ezFoVQoJS8X",
+			"eyJ6aXAiOiJERUYiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYWxnIjoiQTE5MktXIn0.OgLMhZ-2ZhslQyHfzOfyC-qmT6bNg9AdpP59B4jtyxWkQu3eW475WCdiAjojjeyBtVRGQ5vOomwaOIFejY_IekzH6I_taii3.U9x44MF6Wyz5TIwIzwhoxQ.vK7yvSF2beKdNxNY_7n4XdF7JluCGZoxdFJyTJVkSmI.bXRlI8KL-g7gpprQxGmXjVYjYghhWJq7mlCfWI8q2uA",
+		},
+		{
+			"eyJ6aXAiOiJERUYiLCJlbmMiOiJBMTI4R0NNIiwidGFnIjoiR3BjX3pfbjduZjJVZlEtWGdsaTBaQSIsImFsZyI6IkEyNTZHQ01LVyIsIml2IjoiUk40eUdhOVlvYlFhUmZ1TCJ9.Q4ukD6_hZpmASAVcqWJ9Wg.Zfhny_1WNdlp4fH-.3sekDCjkExQCcv28ZW4yrcFnz0vma3vgoenSXA.g8_Ird2Y0itTCDP61du-Yg",
+			"eyJ6aXAiOiJERUYiLCJlbmMiOiJBMTkyR0NNIiwidGFnIjoiWC05UkNVWVh4U3NRelcwelVJS01VUSIsImFsZyI6IkEyNTZHQ01LVyIsIml2IjoiY3JNMnJfa3RrdWpyQ1h5OSJ9.c0q2jCxxV4y1h9u_Xvn7FqUDnbkmNEG4.S_noOTZKuUo9z1l6.ez0RdA25vXMUGH96iXmj3DEVox0J7TasJMnzgg.RbuSPTte_NzTtEEokbc5Ig",
+			"eyJ6aXAiOiJERUYiLCJlbmMiOiJBMjU2R0NNIiwidGFnIjoiWmwyaDFpUW11QWZWd2lJeVp5RHloZyIsImFsZyI6IkEyNTZHQ01LVyIsIml2Ijoib19xZmljb0N0NzNzRWo1QyJ9.NpJxRJ0aqcpekD6HU2u9e6_pL_11JXjWvjfeQnAKkZU.4c5qBcBBrMWi27Lf.NKwNIb4b6cRDJ1TwMKsPrjs7ADn6aNoBdQClVw.yNWmSSRBqQfIQObzj8zDqw",
+			"eyJ6aXAiOiJERUYiLCJlbmMiOiJBMTI4Q0JDLUhTMjU2IiwidGFnIjoiMXdwVEI3LWhjdzZUVXhCbVh2UzdhUSIsImFsZyI6IkEyNTZHQ01LVyIsIml2IjoiOUdIVnZJaDZ0a09vX2pHUSJ9.MFgIhp9mzlq9hoPqqKVKHJ3HL79EBYtV4iNhD63yqiU.UzW5iq8ou21VpZYJgKEN8A.1gOEzA4uAPvHP76GMfs9uLloAV10mKaxiZVAeL7iQA0.i1X_2i0bCAz-soXF9bI_zw",
+			"eyJ6aXAiOiJERUYiLCJlbmMiOiJBMTkyQ0JDLUhTMzg0IiwidGFnIjoiNThocUtsSk15Y1BFUEFRUlNfSzlNUSIsImFsZyI6IkEyNTZHQ01LVyIsIml2IjoiUDh3aTBWMTluVnZqNXpkOSJ9.FXidOWHNFJODO74Thq3J2cC-Z2B8UZkn7SikeosU0bUK6Jx_lzzmUZ-Lafadpdpj.iLfcDbpuBKFiSfiBzUQc7Q.VZK-aD7BFspqfvbwa0wE2wwWxdomzk2IKMetFe8bI44.7wC6rJRGa4x48xbYMd6NH9VzK8uNn4Cb",
+			"eyJ6aXAiOiJERUYiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwidGFnIjoicGcwOEpUcXdzMXdEaXBaRUlpVExoQSIsImFsZyI6IkEyNTZHQ01LVyIsIml2IjoiSlpodk9CdU1RUDFFZTZTNSJ9.wqVgTPm6TcYCTkpbwmn9sW4mgJROH2A3dIdSXo5oKIQUIVbQsmy7KXH8UYO2RS9slMGtb869C8o0My67GKg9dQ.ogrRiLlqjB1S5j-7a05OwA.2Y_LyqhU4S_RXMsB74bxcBacd23J2Sp5Lblw-sOkaUY.XGMiYoU-f3GaEzSvG41vpJP2DMGbeDFoWmkUGLUjc4M",
+			"eyJ6aXAiOiJERUYiLCJlbmMiOiJBMTI4R0NNIiwiYWxnIjoiQTI1NktXIn0.QiIZm9NYfahqYFIbiaoUhCCHjotHMkup.EsU0XLn4FjzzCILn.WuCoQkm9vzo95E7hxBtfYpt-Mooc_vmSTyzj6Q.NbeeYVy6gQPlmhoWDrZwaQ",
+			"eyJ6aXAiOiJERUYiLCJlbmMiOiJBMTkyR0NNIiwiYWxnIjoiQTI1NktXIn0.1ol3j_Lt0Os3UMe2Gypj0o8b77k0FSmqD7kNRNoMa9U.vZ2HMTgN2dgUd42h.JvNcy8-c8sYzOC089VtFSg2BOQx3YF8CqSTuJw.t03LRioWWKN3d7SjinU6SQ",
+			"eyJ6aXAiOiJERUYiLCJlbmMiOiJBMjU2R0NNIiwiYWxnIjoiQTI1NktXIn0.gbkk03l1gyrE9qGEMVtORiyyUqKsgzbqjLd8lw0RQ07WWn--TV4BgA.J8ThH4ac2UhSsMIP.g-W1piEGrdi3tNwQDJXpYm3fQjTf82mtVCrCOg.-vY05P4kiB9FgF2vwrSeXQ",
+			"eyJ6aXAiOiJERUYiLCJlbmMiOiJBMTI4Q0JDLUhTMjU2IiwiYWxnIjoiQTI1NktXIn0.k86pQs7gmQIzuIWRFwesF32XY2xi1WbYxi7XUf_CYlOlehwGCTINHg.3NcC9VzfQgsECISKf4xy-g.v2amdo-rgeGsg-II_tvPukX9D-KAP27xxf2uQJ277Ws.E4LIE3fte3glAnPpnd8D9Q",
+			"eyJ6aXAiOiJERUYiLCJlbmMiOiJBMTkyQ0JDLUhTMzg0IiwiYWxnIjoiQTI1NktXIn0.b8iN0Am3fCUvj7sBd7Z0lpfzBjh1MOgojV7J5rDfrcTU3b35RGYgEV1RdcrtUTBgUwITDjmU7jM.wsSDBFghDga_ERv36I2AOg.6uJsucCb2YReFOJGBdo4zidTIKLUmZBIXfm_M0AJpKk.YwdAfXI3HHcw2wLSnfCRtw4huZQtSKhz",
+			"eyJ6aXAiOiJERUYiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiYWxnIjoiQTI1NktXIn0.akY9pHCbkHPh5VpXIrX0At41XnJIKBR9iMMkf301vKeJNAZYJTxWzeJhFd-DhQ47tMctc3YYkwZkQ5I_9fGYb_f0oBcw4esh.JNwuuHud78h6S99NO1oBQQ.0RwckPYATBgvw67upkAQ1AezETHc-gh3rryz19i5ryc.3XClRTScgzfMgLCHxHHoRF8mm9VVGXv_Ahtx65PskKQ",
+		},
+	}
+
+	for i, msgs := range aesSampleMessages {
+		for _, msg := range msgs {
+			obj, err := ParseEncrypted(msg)
+			if err != nil {
+				t.Error("unable to parse message", msg, err)
+				continue
+			}
+			plaintext, err := obj.Decrypt(aesTestKeys[i])
+			if err != nil {
+				t.Error("unable to decrypt message", msg, err)
+				continue
+			}
+			if string(plaintext) != "Lorem ipsum dolor sit amet" {
+				t.Error("plaintext is not what we expected for msg", msg)
+			}
+		}
+	}
+}
+
+// Test vectors generated with jose4j
+func TestSampleJose4jJWEMessagesECDH(t *testing.T) {
+	ecTestKey := &ecdsa.PrivateKey{
+		PublicKey: ecdsa.PublicKey{
+			Curve: elliptic.P256(),
+			X:     fromBase64Int("weNJy2HscCSM6AEDTDg04biOvhFhyyWvOHQfeF_PxMQ"),
+			Y:     fromBase64Int("e8lnCO-AlStT-NJVX-crhB7QRYhiix03illJOVAOyck"),
+		},
+		D: fromBase64Int("VEmDZpDXXK8p8N0Cndsxs924q6nS1RXFASRl6BfUqdw"),
+	}
+
+	ecSampleMessages := []string{
+		"eyJhbGciOiJFQ0RILUVTIiwiZW5jIjoiQTEyOENCQy1IUzI1NiIsImVwayI6eyJrdHkiOiJFQyIsIngiOiJTQzAtRnJHUkVvVkpKSmg1TGhORmZqZnFXMC1XSUFyd3RZMzJzQmFQVVh3IiwieSI6ImFQMWlPRENveU9laTVyS1l2VENMNlRMZFN5UEdUN0djMnFsRnBwNXdiWFEiLCJjcnYiOiJQLTI1NiJ9fQ..3mifklTnTTGuA_etSUBBCw.dj8KFM8OlrQ3rT35nHcHZ7A5p84VB2OZb054ghSjS-M.KOIgnJjz87LGqMtikXGxXw",
+		"eyJhbGciOiJFQ0RILUVTIiwiZW5jIjoiQTE5MkNCQy1IUzM4NCIsImVwayI6eyJrdHkiOiJFQyIsIngiOiJUaHRGc0lRZ1E5MkZOYWFMbUFDQURLbE93dmNGVlRORHc4ampfWlJidUxjIiwieSI6IjJmRDZ3UXc3YmpYTm1nVThXMGpFbnl5ZUZkX3Y4ZmpDa3l1R29vTFhGM0EiLCJjcnYiOiJQLTI1NiJ9fQ..90zFayMkKc-fQC_19f6P3A.P1Y_7lMnfkUQOXW_en31lKZ3zAn1nEYn6fXLjmyVPrQ.hrgwy1cePVfhMWT0h-crKTXldglHZ-4g",
+		"eyJhbGciOiJFQ0RILUVTIiwiZW5jIjoiQTI1NkNCQy1IUzUxMiIsImVwayI6eyJrdHkiOiJFQyIsIngiOiI5R1Z6c3VKNWgySl96UURVUFR3WU5zUkFzVzZfY2RzN0pELVQ2RDREQ1ZVIiwieSI6InFZVGl1dVU4aTB1WFpoaS14VGlRNlZJQm5vanFoWENPVnpmWm1pR2lRTEUiLCJjcnYiOiJQLTI1NiJ9fQ..v2reRlDkIsw3eWEsTCc1NA.0qakrFdbhtBCTSl7EREf9sxgHBP9I-Xw29OTJYnrqP8.54ozViEBYYmRkcKp7d2Ztt4hzjQ9Vb5zCeijN_RQrcI",
+		"eyJhbGciOiJFQ0RILUVTK0EyNTZLVyIsImVuYyI6IkExMjhDQkMtSFMyNTYiLCJlcGsiOnsia3R5IjoiRUMiLCJ4IjoiOElUemg3VVFaaUthTWtfME9qX1hFaHZENXpUWjE2Ti13WVdjeTJYUC1tdyIsInkiOiJPNUJiVEk0bUFpU005ZmpCejBRU3pXaU5vbnl3cWlQLUN0RGgwdnNGYXNRIiwiY3J2IjoiUC0yNTYifX0.D3DP3wqPvJv4TYYfhnfrOG6nsM-MMH_CqGfnOGjgdXHNF7xRwEJBOA.WL9Kz3gNYA7S5Rs5mKcXmA.EmQkXhO_nFqAwxJWaM0DH4s3pmCscZovB8YWJ3Ru4N8.Bf88uzwfxiyTjpejU5B0Ng",
+		"eyJhbGciOiJFQ0RILUVTK0EyNTZLVyIsImVuYyI6IkExOTJDQkMtSFMzODQiLCJlcGsiOnsia3R5IjoiRUMiLCJ4IjoiMjlJMk4zRkF0UlBlNGhzYjRLWlhTbmVyV0wyTVhtSUN1LXJJaXhNSHpJQSIsInkiOiJvMjY1bzFReEdmbDhzMHQ0U1JROS00RGNpc3otbXh4NlJ6WVF4SktyeWpJIiwiY3J2IjoiUC0yNTYifX0.DRmsmXz6fCnLc_njDIKdpM7Oc4jTqd_yd9J94TOUksAstEUkAl9Ie3Wg-Ji_LzbdX2xRLXIimcw.FwJOHPQhnqKJCfxt1_qRnQ.ssx3q1ZYILsMTln5q-K8HVn93BVPI5ViusstKMxZzRs.zzcfzWNYSdNDdQ4CiHfymj0bePaAbVaT",
+		"eyJhbGciOiJFQ0RILUVTK0EyNTZLVyIsImVuYyI6IkEyNTZDQkMtSFM1MTIiLCJlcGsiOnsia3R5IjoiRUMiLCJ4IjoiRUp6bTViQnRzVXJNYTl2Y1Q2d1hZRXI3ZjNMcjB0N1V4SDZuZzdGcFF0VSIsInkiOiJRYTNDSDllVTFXYjItdFdVSDN3Sk9fTDVMZXRsRUlMQWNkNE9XR2tFd0hZIiwiY3J2IjoiUC0yNTYifX0.5WxwluZpVWAOJdVrsnDIlEc4_wfRE1gXOaQyx_rKkElNz157Ykf-JsAD7aEvXfx--NKF4js5zYyjeCtxWBhRWPOoNNZJlqV_.Iuo82-qsP2S1SgQQklAnrw.H4wB6XoLKOKWCu6Y3LPAEuHkvyvr-xAh4IBm53uRF8g._fOLKq0bqDZ8KNjni_MJ4olHNaYz376dV9eNmp9O9PU",
+		"eyJhbGciOiJFQ0RILUVTK0ExOTJLVyIsImVuYyI6IkExMjhDQkMtSFMyNTYiLCJlcGsiOnsia3R5IjoiRUMiLCJ4IjoiZktNSG5sRkoxajBTSnJ3WGtVWlpaX3BtWHdUQlJtcHhlaTkxdUpaczUycyIsInkiOiJLRkxKaXhEUTJQcjEybWp1aFdYb3pna2U1V3lhWnhmTWlxZkJ0OEJpbkRvIiwiY3J2IjoiUC0yNTYifX0.2LSD2Mw4tyYJyfsmpVmzBtJRd12jMEYGdlhFbaXIbKi5A33CGNQ1tg.s40aAjmZOvK8Us86FCBdHg.jpYSMAKp___oMCoWM495mTfbi_YC80ObeoCmGE3H_gs.A6V-jJJRY1yz24CaXGUbzg",
+		"eyJhbGciOiJFQ0RILUVTK0ExOTJLVyIsImVuYyI6IkExOTJDQkMtSFMzODQiLCJlcGsiOnsia3R5IjoiRUMiLCJ4IjoiSDRxcFUzeWtuRktWRnV4SmxLa3NZSE5ieHF3aXM0WWtCVVFHVE1Td05JQSIsInkiOiJHb0lpRUZaUGRRSHJCbVR4ZTA3akJoZmxrdWNqUjVoX1QwNWVXc3Zib0prIiwiY3J2IjoiUC0yNTYifX0.KTrwwV2uzD--gf3PGG-kjEAGgi7u0eMqZPZfa4kpyFGm3x8t2m1NHdz3t9rfiqjuaqsxPKhF4gs.cu16fEOzYaSxhHu_Ht9w4g.BRJdxVBI9spVtY5KQ6gTR4CNcKvmLUMKZap0AO-RF2I.DZyUaa2p6YCIaYtjWOjC9GN_VIYgySlZ",
+		"eyJhbGciOiJFQ0RILUVTK0ExOTJLVyIsImVuYyI6IkEyNTZDQkMtSFM1MTIiLCJlcGsiOnsia3R5IjoiRUMiLCJ4IjoieDBYSGRkSGM2Q0ktSnlfbUVMOEZZRExhWnV0UkVFczR4c3BMQmcwZk1jbyIsInkiOiJEa0xzOUJGTlBkTTVTNkpLYVJ3cnV1TWMwcUFzWW9yNW9fZWp6NXBNVXFrIiwiY3J2IjoiUC0yNTYifX0.mfCxJ7JYIqTMqcAh5Vp2USF0eF7OhOeluqda7YagOUJNwxA9wC9o23DSoLUylfrZUfanZrJJJcG69awlv-LY7anOLHlp3Ht5.ec48A_JWb4qa_PVHWZaTfQ.kDAjIDb3LzJpfxNh-DiAmAuaKMYaOGSTb0rkiJLuVeY.oxGCpPlii4pr89XMk4b9s084LucTqPGU6TLbOW2MZoc",
+		"eyJhbGciOiJFQ0RILUVTK0ExMjhLVyIsImVuYyI6IkExMjhDQkMtSFMyNTYiLCJlcGsiOnsia3R5IjoiRUMiLCJ4IjoiQXB5TnlqU2d0bmRUcFg0eENYenNDRnZva1l3X18weXg2dGRUYzdPUUhIMCIsInkiOiJYUHdHMDVDaW1vOGlhWmxZbDNsMEp3ZllhY1FZWHFuM2RRZEJUWFpldDZBIiwiY3J2IjoiUC0yNTYifX0.yTA2PwK9IPqkaGPenZ9R-gOn9m9rvcSEfuX_Nm8AkuwHIYLzzYeAEA.ZW1F1iyHYKfo-YoanNaIVg.PouKQD94DlPA5lbpfGJXY-EJhidC7l4vSayVN2vVzvA.MexquqtGaXKUvX7WBmD4bA",
+		"eyJhbGciOiJFQ0RILUVTK0ExMjhLVyIsImVuYyI6IkExOTJDQkMtSFMzODQiLCJlcGsiOnsia3R5IjoiRUMiLCJ4IjoiaDRWeGNzNVUzWk1fTlp4WmJxQ3hMTVB5UmEtR2ktSVNZa0xDTzE1RHJkZyIsInkiOiJFeVotS3dWNVE5OXlnWk5zU0lpSldpR3hqbXNLUk1WVE5sTTNSd1VYTFRvIiwiY3J2IjoiUC0yNTYifX0.wo56VISyL1QAbi2HLuVut5NGF2FvxKt7B8zHzJ3FpmavPozfbVZV08-GSYQ6jLQWJ4xsO80I4Kg.3_9Bo5ozvD96WHGhqp_tfQ.48UkJ6jk6WK70QItb2QZr0edKH7O-aMuVahTEeqyfW4.ulMlY2tbC341ct20YSmNdtc84FRz1I4g",
+		"eyJhbGciOiJFQ0RILUVTK0ExMjhLVyIsImVuYyI6IkEyNTZDQkMtSFM1MTIiLCJlcGsiOnsia3R5IjoiRUMiLCJ4IjoiN0xZRzZZWTJkel9ZaGNvNnRCcG1IX0tPREQ2X2hwX05tajdEc1c2RXgxcyIsInkiOiI5Y2lPeDcwUkdGT0tpVnBRX0NHQXB5NVlyeThDazBmUkpwNHVrQ2tjNmQ0IiwiY3J2IjoiUC0yNTYifX0.bWwW3J80k46HG1fQAZxUroko2OO8OKkeRavr_o3AnhJDMvp78OR229x-fZUaBm4uWv27_Yjm0X9T2H2lhlIli2Rl9v1PNC77.1NmsJBDGI1fDjRzyc4mtyA.9KfCFynQj7LmJq08qxAG4c-6ZPz1Lh3h3nUbgVwB0TI.cqech0d8XHzWfkWqgKZq1SlAfmO0PUwOsNVkuByVGWk",
+	}
+
+	for _, msg := range ecSampleMessages {
+		obj, err := ParseEncrypted(msg)
+		if err != nil {
+			t.Error("unable to parse message", msg, err)
+			continue
+		}
+		plaintext, err := obj.Decrypt(ecTestKey)
+		if err != nil {
+			t.Error("unable to decrypt message", msg, err)
+			continue
+		}
+		if string(plaintext) != "Lorem ipsum dolor sit amet." {
+			t.Error("plaintext is not what we expected for msg", msg)
+		}
+	}
+}
+
+func TestSampleAESCBCHMACMessagesFromNodeJose(t *testing.T) {
+	samples := []struct {
+		key        []byte
+		ciphertext string
+	}{
+		// A256CBC
+		{
+			fromBase64URLBytes("5SeJepAQ8Hmza4bM_wAQjvW0cFbPo_0TBc-sPblNBKs5SeJepAQ8Hmza4bM_wAQjvW0cFbPo_0TBc-sPblNBKs"),
+			`{"protected":"eyJjdHkiOiJKV1QiLCJhbGciOiJkaXIiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwia2lkIjoidGVzdDUxMiJ9","iv":"9Gloee8teNSSjXG_ifPRnA","ciphertext":"x12B46biQ6axL4ee5mHwpA","tag":"ec7qQ4c8Gyx57BelJoULIW6GRW7Bccm44d0iEfU4yIw"}`,
+		},
+		// A192CBC
+		{
+			fromBase64URLBytes("b0ha2QPh_1D-wxtRK3jzzg7MEuD1g91zb0ha2QPh_1D-wxtRK3jzzg7MEuD1g91z"),
+			`{"protected":"eyJjdHkiOiJKV1QiLCJhbGciOiJkaXIiLCJlbmMiOiJBMTkyQ0JDLUhTMzg0Iiwia2lkIjoidGVzdDM4NCJ9","iv":"zocDwPrIX4PZ7ObdoP3m7A","ciphertext":"kLTpZfiX7Qv3r2TaZzUCFg","tag":"Hxk9xu72WHBos5JWpShFmasiNbVqBQqi"}`,
+		},
+		// A128CBC
+		{
+			fromBase64URLBytes("5SeJepAQ8Hmza4bM_wAQjvW0cFbPo_0TBc-sPblNBKs"),
+			`{"protected":"eyJjdHkiOiJKV1QiLCJhbGciOiJkaXIiLCJlbmMiOiJBMTI4Q0JDLUhTMjU2Iiwia2lkIjoidGVzdDI1NiJ9","iv":"oDjxSLU4joRZR9YybE83RQ","ciphertext":"y93rgZp209nvmbX8hvN0Zg","tag":"NrivXSKPqzkmcpQTThXpzQ"}`,
+		},
+	}
+
+	for _, sample := range samples {
+		obj, err := ParseEncrypted(sample.ciphertext)
+		if err != nil {
+			t.Error("unable to parse message", sample.ciphertext, err)
+			continue
+		}
+		plaintext, err := obj.Decrypt(sample.key)
+		if err != nil {
+			t.Error("unable to decrypt message", sample.ciphertext, err)
+			continue
+		}
+		if string(plaintext) != "Hello World" {
+			t.Error("plaintext is not what we expected for msg", sample.ciphertext, string(plaintext))
+		}
+	}
+}
+
+func TestTamperedJWE(t *testing.T) {
+	key := []byte("1234567890123456")
+
+	encrypter, _ := NewEncrypter(A128GCM,
+		Recipient{Algorithm: DIRECT, Key: key}, nil)
+
+	var plaintext = []byte("Lorem ipsum dolor sit amet")
+	object, _ := encrypter.Encrypt(plaintext)
+
+	serialized := object.FullSerialize()
+
+	// Inject a longer iv
+	serialized = regexp.MustCompile(`"iv":"[^"]+"`).
+		ReplaceAllString(serialized, `"iv":"UotNnfiavtNOOSZAcfI03i"`)
+
+	object, _ = ParseEncrypted(serialized)
+
+	_, err := object.Decrypt(key)
+	if err == nil {
+		t.Error("Decrypt() on invalid object should fail")
+	}
+}
+
+func TestJWEWithNullAlg(t *testing.T) {
+	// {"alg":null,"enc":"A128GCM"}
+	serialized := `{"protected":"eyJhbGciOm51bGwsImVuYyI6IkExMjhHQ00ifQ"}`
+	ParseEncrypted(serialized)
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/jwk-keygen/README.md b/vendor/gopkg.in/square/go-jose.v2/jwk-keygen/README.md
new file mode 100644
index 0000000..b4d3a4b
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/jwk-keygen/README.md
@@ -0,0 +1,35 @@
+# JWK Key Generator
+
+The `jwk-keygen` command line utility generates keypairs used for asymmetric
+encryption and signing algorithms in JSON Web Key (JWK) format.
+
+## Usage
+
+The utility requires specification of both desired algorithm (`alg`) and key
+usage (`use`) to remind that same keypair should never be used both for
+encryption and signing.
+
+Algorithms are selected via the `--alg` flag, which influence the `alg` header.
+For JWE (`--use=enc`), `--alg` specifies the key management algorithm (e.g.
+`RSA-OAEP`). For JWS (`--use=sig`), `--alg` specifies the signature algorithm
+(e.g. `PS256`).
+
+Output file is determined by specified usage, algorithm and Key ID, e.g.
+`jwk-keygen --use=sig --alg=RS512 --kid=test` produces files
+`jwk_sig_RS512_test` and `jwk_sig_RS512_test.pub`. Keys are sent to stdout when
+no Key ID is specified: neither pre-defined nor random one.
+
+## Examples
+
+### RSA 2048
+
+Generate RSA/2048 key for encryption and output to stdout.
+
+    jwk-keygen --use enc --alg RSA-OAEP
+
+### Custom key length
+
+Generate RSA/4096 key for signing and store to files.
+
+    jwk-keygen --use sig --alg RS256 --bits 4096 --kid test
+
diff --git a/vendor/gopkg.in/square/go-jose.v2/jwk-keygen/main.go b/vendor/gopkg.in/square/go-jose.v2/jwk-keygen/main.go
new file mode 100644
index 0000000..d3fc496
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/jwk-keygen/main.go
@@ -0,0 +1,200 @@
+/*-
+ * Copyright 2017 Square Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package main
+
+import (
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/rsa"
+	"encoding/base32"
+	"errors"
+	"fmt"
+	"golang.org/x/crypto/ed25519"
+	"io"
+	"os"
+
+	"gopkg.in/alecthomas/kingpin.v2"
+	"gopkg.in/square/go-jose.v2"
+)
+
+var (
+	app = kingpin.New("jwk-keygen", "A command-line utility to generate public/pirvate keypairs in JWK format.")
+
+	use = app.Flag("use", "Desrired key use").Required().Enum("enc", "sig")
+	alg = app.Flag("alg", "Generate key to be used for ALG").Required().Enum(
+		// `sig`
+		string(jose.ES256), string(jose.ES384), string(jose.ES512), string(jose.EdDSA),
+		string(jose.RS256), string(jose.RS384), string(jose.RS512), string(jose.PS256), string(jose.PS384), string(jose.PS512),
+		// `enc`
+		string(jose.RSA1_5), string(jose.RSA_OAEP), string(jose.RSA_OAEP_256),
+		string(jose.ECDH_ES), string(jose.ECDH_ES_A128KW), string(jose.ECDH_ES_A192KW), string(jose.ECDH_ES_A256KW),
+	)
+	bits    = app.Flag("bits", "Key size in bits").Int()
+	kid     = app.Flag("kid", "Key ID").String()
+	kidRand = app.Flag("kid-rand", "Generate random Key ID").Bool()
+)
+
+// KeygenSig generates keypair for corresponding SignatureAlgorithm.
+func KeygenSig(alg jose.SignatureAlgorithm, bits int) (crypto.PublicKey, crypto.PrivateKey, error) {
+	switch alg {
+	case jose.ES256, jose.ES384, jose.ES512, jose.EdDSA:
+		keylen := map[jose.SignatureAlgorithm]int{
+			jose.ES256: 256,
+			jose.ES384: 384,
+			jose.ES512: 521, // sic!
+			jose.EdDSA: 256,
+		}
+		if bits != 0 && bits != keylen[alg] {
+			return nil, nil, errors.New("this `alg` does not support arbitrary key length")
+		}
+	case jose.RS256, jose.RS384, jose.RS512, jose.PS256, jose.PS384, jose.PS512:
+		if bits == 0 {
+			bits = 2048
+		}
+		if bits < 2048 {
+			return nil, nil, errors.New("too short key for RSA `alg`, 2048+ is required")
+		}
+	}
+	switch alg {
+	case jose.ES256:
+		// The cryptographic operations are implemented using constant-time algorithms.
+		key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+		return key.Public(), key, err
+	case jose.ES384:
+		// NB: The cryptographic operations do not use constant-time algorithms.
+		key, err := ecdsa.GenerateKey(elliptic.P384(), rand.Reader)
+		return key.Public(), key, err
+	case jose.ES512:
+		// NB: The cryptographic operations do not use constant-time algorithms.
+		key, err := ecdsa.GenerateKey(elliptic.P521(), rand.Reader)
+		return key.Public(), key, err
+	case jose.EdDSA:
+		pub, key, err := ed25519.GenerateKey(rand.Reader)
+		return pub, key, err
+	case jose.RS256, jose.RS384, jose.RS512, jose.PS256, jose.PS384, jose.PS512:
+		key, err := rsa.GenerateKey(rand.Reader, bits)
+		return key.Public(), key, err
+	default:
+		return nil, nil, errors.New("unknown `alg` for `use` = `sig`")
+	}
+}
+
+// KeygenEnc generates keypair for corresponding KeyAlgorithm.
+func KeygenEnc(alg jose.KeyAlgorithm, bits int) (crypto.PublicKey, crypto.PrivateKey, error) {
+	switch alg {
+	case jose.RSA1_5, jose.RSA_OAEP, jose.RSA_OAEP_256:
+		if bits == 0 {
+			bits = 2048
+		}
+		if bits < 2048 {
+			return nil, nil, errors.New("too short key for RSA `alg`, 2048+ is required")
+		}
+		key, err := rsa.GenerateKey(rand.Reader, bits)
+		return key.Public(), key, err
+	case jose.ECDH_ES, jose.ECDH_ES_A128KW, jose.ECDH_ES_A192KW, jose.ECDH_ES_A256KW:
+		var crv elliptic.Curve
+		switch bits {
+		case 0, 256:
+			crv = elliptic.P256()
+		case 384:
+			crv = elliptic.P384()
+		case 521:
+			crv = elliptic.P521()
+		default:
+			return nil, nil, errors.New("unknown elliptic curve bit length, use one of 256, 384, 521")
+		}
+		key, err := ecdsa.GenerateKey(crv, rand.Reader)
+		return key.Public(), key, err
+	default:
+		return nil, nil, errors.New("unknown `alg` for `use` = `enc`")
+	}
+}
+
+func main() {
+	app.Version("v2")
+	kingpin.MustParse(app.Parse(os.Args[1:]))
+
+	if *kidRand {
+		if *kid == "" {
+			b := make([]byte, 5)
+			_, err := rand.Read(b)
+			app.FatalIfError(err, "can't Read() crypto/rand")
+			*kid = base32.StdEncoding.EncodeToString(b)
+		} else {
+			app.FatalUsage("can't combine --kid and --kid-rand")
+		}
+	}
+
+	var privKey crypto.PublicKey
+	var pubKey crypto.PrivateKey
+	var err error
+	switch *use {
+	case "sig":
+		pubKey, privKey, err = KeygenSig(jose.SignatureAlgorithm(*alg), *bits)
+	case "enc":
+		pubKey, privKey, err = KeygenEnc(jose.KeyAlgorithm(*alg), *bits)
+	}
+	app.FatalIfError(err, "unable to generate key")
+
+	priv := jose.JSONWebKey{Key: privKey, KeyID: *kid, Algorithm: *alg, Use: *use}
+	pub := jose.JSONWebKey{Key: pubKey, KeyID: *kid, Algorithm: *alg, Use: *use}
+
+	if priv.IsPublic() || !pub.IsPublic() || !priv.Valid() || !pub.Valid() {
+		app.Fatalf("invalid keys were generated")
+	}
+
+	privJS, err := priv.MarshalJSON()
+	app.FatalIfError(err, "can't Marshal private key to JSON")
+	pubJS, err := pub.MarshalJSON()
+	app.FatalIfError(err, "can't Marshal public key to JSON")
+
+	if *kid == "" {
+		fmt.Printf("==> jwk_%s.pub <==\n", *alg)
+		fmt.Println(string(pubJS))
+		fmt.Printf("==> jwk_%s <==\n", *alg)
+		fmt.Println(string(privJS))
+	} else {
+		// JWK Thumbprint (RFC7638) is not used for key id because of
+		// lack of canonical representation.
+		fname := fmt.Sprintf("jwk_%s_%s_%s", *use, *alg, *kid)
+		err = writeNewFile(fname+".pub", pubJS, 0444)
+		app.FatalIfError(err, "can't write public key to file %s.pub", fname)
+		fmt.Printf("Written public key to %s.pub\n", fname)
+		err = writeNewFile(fname, privJS, 0400)
+		app.FatalIfError(err, "cant' write private key to file %s", fname)
+		fmt.Printf("Written private key to %s\n", fname)
+	}
+}
+
+// writeNewFile is shameless copy-paste from ioutil.WriteFile with a bit
+// different flags for OpenFile.
+func writeNewFile(filename string, data []byte, perm os.FileMode) error {
+	f, err := os.OpenFile(filename, os.O_WRONLY|os.O_CREATE|os.O_EXCL, perm)
+	if err != nil {
+		return err
+	}
+	n, err := f.Write(data)
+	if err == nil && n < len(data) {
+		err = io.ErrShortWrite
+	}
+	if err1 := f.Close(); err == nil {
+		err = err1
+	}
+	return err
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/jwk.go b/vendor/gopkg.in/square/go-jose.v2/jwk.go
new file mode 100644
index 0000000..6cb8adb
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/jwk.go
@@ -0,0 +1,608 @@
+/*-
+ * Copyright 2014 Square Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package jose
+
+import (
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"math/big"
+	"reflect"
+	"strings"
+
+	"golang.org/x/crypto/ed25519"
+
+	"gopkg.in/square/go-jose.v2/json"
+)
+
+// rawJSONWebKey represents a public or private key in JWK format, used for parsing/serializing.
+type rawJSONWebKey struct {
+	Use string      `json:"use,omitempty"`
+	Kty string      `json:"kty,omitempty"`
+	Kid string      `json:"kid,omitempty"`
+	Crv string      `json:"crv,omitempty"`
+	Alg string      `json:"alg,omitempty"`
+	K   *byteBuffer `json:"k,omitempty"`
+	X   *byteBuffer `json:"x,omitempty"`
+	Y   *byteBuffer `json:"y,omitempty"`
+	N   *byteBuffer `json:"n,omitempty"`
+	E   *byteBuffer `json:"e,omitempty"`
+	// -- Following fields are only used for private keys --
+	// RSA uses D, P and Q, while ECDSA uses only D. Fields Dp, Dq, and Qi are
+	// completely optional. Therefore for RSA/ECDSA, D != nil is a contract that
+	// we have a private key whereas D == nil means we have only a public key.
+	D  *byteBuffer `json:"d,omitempty"`
+	P  *byteBuffer `json:"p,omitempty"`
+	Q  *byteBuffer `json:"q,omitempty"`
+	Dp *byteBuffer `json:"dp,omitempty"`
+	Dq *byteBuffer `json:"dq,omitempty"`
+	Qi *byteBuffer `json:"qi,omitempty"`
+	// Certificates
+	X5c []string `json:"x5c,omitempty"`
+}
+
+// JSONWebKey represents a public or private key in JWK format.
+type JSONWebKey struct {
+	Key          interface{}
+	Certificates []*x509.Certificate
+	KeyID        string
+	Algorithm    string
+	Use          string
+}
+
+// MarshalJSON serializes the given key to its JSON representation.
+func (k JSONWebKey) MarshalJSON() ([]byte, error) {
+	var raw *rawJSONWebKey
+	var err error
+
+	switch key := k.Key.(type) {
+	case ed25519.PublicKey:
+		raw = fromEdPublicKey(key)
+	case *ecdsa.PublicKey:
+		raw, err = fromEcPublicKey(key)
+	case *rsa.PublicKey:
+		raw = fromRsaPublicKey(key)
+	case ed25519.PrivateKey:
+		raw, err = fromEdPrivateKey(key)
+	case *ecdsa.PrivateKey:
+		raw, err = fromEcPrivateKey(key)
+	case *rsa.PrivateKey:
+		raw, err = fromRsaPrivateKey(key)
+	case []byte:
+		raw, err = fromSymmetricKey(key)
+	default:
+		return nil, fmt.Errorf("square/go-jose: unknown key type '%s'", reflect.TypeOf(key))
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	raw.Kid = k.KeyID
+	raw.Alg = k.Algorithm
+	raw.Use = k.Use
+
+	for _, cert := range k.Certificates {
+		raw.X5c = append(raw.X5c, base64.StdEncoding.EncodeToString(cert.Raw))
+	}
+
+	return json.Marshal(raw)
+}
+
+// UnmarshalJSON reads a key from its JSON representation.
+func (k *JSONWebKey) UnmarshalJSON(data []byte) (err error) {
+	var raw rawJSONWebKey
+	err = json.Unmarshal(data, &raw)
+	if err != nil {
+		return err
+	}
+
+	var key interface{}
+	switch raw.Kty {
+	case "EC":
+		if raw.D != nil {
+			key, err = raw.ecPrivateKey()
+		} else {
+			key, err = raw.ecPublicKey()
+		}
+	case "RSA":
+		if raw.D != nil {
+			key, err = raw.rsaPrivateKey()
+		} else {
+			key, err = raw.rsaPublicKey()
+		}
+	case "oct":
+		key, err = raw.symmetricKey()
+	case "OKP":
+		if raw.Crv == "Ed25519" && raw.X != nil {
+			if raw.D != nil {
+				key, err = raw.edPrivateKey()
+			} else {
+				key, err = raw.edPublicKey()
+			}
+		} else {
+			err = fmt.Errorf("square/go-jose: unknown curve %s'", raw.Crv)
+		}
+	default:
+		err = fmt.Errorf("square/go-jose: unknown json web key type '%s'", raw.Kty)
+	}
+
+	if err == nil {
+		*k = JSONWebKey{Key: key, KeyID: raw.Kid, Algorithm: raw.Alg, Use: raw.Use}
+
+		k.Certificates, err = parseCertificateChain(raw.X5c)
+		if err != nil {
+			return fmt.Errorf("failed to unmarshal x5c field: %s", err)
+		}
+	}
+
+	return
+}
+
+// JSONWebKeySet represents a JWK Set object.
+type JSONWebKeySet struct {
+	Keys []JSONWebKey `json:"keys"`
+}
+
+// Key convenience method returns keys by key ID. Specification states
+// that a JWK Set "SHOULD" use distinct key IDs, but allows for some
+// cases where they are not distinct. Hence method returns a slice
+// of JSONWebKeys.
+func (s *JSONWebKeySet) Key(kid string) []JSONWebKey {
+	var keys []JSONWebKey
+	for _, key := range s.Keys {
+		if key.KeyID == kid {
+			keys = append(keys, key)
+		}
+	}
+
+	return keys
+}
+
+const rsaThumbprintTemplate = `{"e":"%s","kty":"RSA","n":"%s"}`
+const ecThumbprintTemplate = `{"crv":"%s","kty":"EC","x":"%s","y":"%s"}`
+const edThumbprintTemplate = `{"crv":"%s","kty":"OKP",x":"%s"}`
+
+func ecThumbprintInput(curve elliptic.Curve, x, y *big.Int) (string, error) {
+	coordLength := curveSize(curve)
+	crv, err := curveName(curve)
+	if err != nil {
+		return "", err
+	}
+
+	if len(x.Bytes()) > coordLength || len(y.Bytes()) > coordLength {
+		return "", errors.New("square/go-jose: invalid elliptic key (too large)")
+	}
+
+	return fmt.Sprintf(ecThumbprintTemplate, crv,
+		newFixedSizeBuffer(x.Bytes(), coordLength).base64(),
+		newFixedSizeBuffer(y.Bytes(), coordLength).base64()), nil
+}
+
+func rsaThumbprintInput(n *big.Int, e int) (string, error) {
+	return fmt.Sprintf(rsaThumbprintTemplate,
+		newBufferFromInt(uint64(e)).base64(),
+		newBuffer(n.Bytes()).base64()), nil
+}
+
+func edThumbprintInput(ed ed25519.PublicKey) (string, error) {
+	crv := "Ed25519"
+	if len(ed) > 32 {
+		return "", errors.New("square/go-jose: invalid elliptic key (too large)")
+	}
+	return fmt.Sprintf(edThumbprintTemplate, crv,
+		newFixedSizeBuffer(ed, 32).base64()), nil
+}
+
+// Thumbprint computes the JWK Thumbprint of a key using the
+// indicated hash algorithm.
+func (k *JSONWebKey) Thumbprint(hash crypto.Hash) ([]byte, error) {
+	var input string
+	var err error
+	switch key := k.Key.(type) {
+	case ed25519.PublicKey:
+		input, err = edThumbprintInput(key)
+	case *ecdsa.PublicKey:
+		input, err = ecThumbprintInput(key.Curve, key.X, key.Y)
+	case *ecdsa.PrivateKey:
+		input, err = ecThumbprintInput(key.Curve, key.X, key.Y)
+	case *rsa.PublicKey:
+		input, err = rsaThumbprintInput(key.N, key.E)
+	case *rsa.PrivateKey:
+		input, err = rsaThumbprintInput(key.N, key.E)
+	case ed25519.PrivateKey:
+		input, err = edThumbprintInput(ed25519.PublicKey(key[32:]))
+	default:
+		return nil, fmt.Errorf("square/go-jose: unknown key type '%s'", reflect.TypeOf(key))
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	h := hash.New()
+	h.Write([]byte(input))
+	return h.Sum(nil), nil
+}
+
+// IsPublic returns true if the JWK represents a public key (not symmetric, not private).
+func (k *JSONWebKey) IsPublic() bool {
+	switch k.Key.(type) {
+	case *ecdsa.PublicKey, *rsa.PublicKey, ed25519.PublicKey:
+		return true
+	default:
+		return false
+	}
+}
+
+// Public creates JSONWebKey with corresponding publik key if JWK represents asymmetric private key.
+func (k *JSONWebKey) Public() JSONWebKey {
+	if k.IsPublic() {
+		return *k
+	}
+	ret := *k
+	switch key := k.Key.(type) {
+	case *ecdsa.PrivateKey:
+		ret.Key = key.Public()
+	case *rsa.PrivateKey:
+		ret.Key = key.Public()
+	case ed25519.PrivateKey:
+		ret.Key = key.Public()
+	default:
+		return JSONWebKey{} // returning invalid key
+	}
+	return ret
+}
+
+// Valid checks that the key contains the expected parameters.
+func (k *JSONWebKey) Valid() bool {
+	if k.Key == nil {
+		return false
+	}
+	switch key := k.Key.(type) {
+	case *ecdsa.PublicKey:
+		if key.Curve == nil || key.X == nil || key.Y == nil {
+			return false
+		}
+	case *ecdsa.PrivateKey:
+		if key.Curve == nil || key.X == nil || key.Y == nil || key.D == nil {
+			return false
+		}
+	case *rsa.PublicKey:
+		if key.N == nil || key.E == 0 {
+			return false
+		}
+	case *rsa.PrivateKey:
+		if key.N == nil || key.E == 0 || key.D == nil || len(key.Primes) < 2 {
+			return false
+		}
+	case ed25519.PublicKey:
+		if len(key) != 32 {
+			return false
+		}
+	case ed25519.PrivateKey:
+		if len(key) != 64 {
+			return false
+		}
+	default:
+		return false
+	}
+	return true
+}
+
+func (key rawJSONWebKey) rsaPublicKey() (*rsa.PublicKey, error) {
+	if key.N == nil || key.E == nil {
+		return nil, fmt.Errorf("square/go-jose: invalid RSA key, missing n/e values")
+	}
+
+	return &rsa.PublicKey{
+		N: key.N.bigInt(),
+		E: key.E.toInt(),
+	}, nil
+}
+
+func fromEdPublicKey(pub ed25519.PublicKey) *rawJSONWebKey {
+	return &rawJSONWebKey{
+		Kty: "OKP",
+		Crv: "Ed25519",
+		X:   newBuffer(pub),
+	}
+}
+
+func fromRsaPublicKey(pub *rsa.PublicKey) *rawJSONWebKey {
+	return &rawJSONWebKey{
+		Kty: "RSA",
+		N:   newBuffer(pub.N.Bytes()),
+		E:   newBufferFromInt(uint64(pub.E)),
+	}
+}
+
+func (key rawJSONWebKey) ecPublicKey() (*ecdsa.PublicKey, error) {
+	var curve elliptic.Curve
+	switch key.Crv {
+	case "P-256":
+		curve = elliptic.P256()
+	case "P-384":
+		curve = elliptic.P384()
+	case "P-521":
+		curve = elliptic.P521()
+	default:
+		return nil, fmt.Errorf("square/go-jose: unsupported elliptic curve '%s'", key.Crv)
+	}
+
+	if key.X == nil || key.Y == nil {
+		return nil, errors.New("square/go-jose: invalid EC key, missing x/y values")
+	}
+
+	// The length of this octet string MUST be the full size of a coordinate for
+	// the curve specified in the "crv" parameter.
+	// https://tools.ietf.org/html/rfc7518#section-6.2.1.2
+	if curveSize(curve) != len(key.X.data) {
+		return nil, fmt.Errorf("square/go-jose: invalid EC private key, wrong length for x")
+	}
+
+	if curveSize(curve) != len(key.Y.data) {
+		return nil, fmt.Errorf("square/go-jose: invalid EC private key, wrong length for y")
+	}
+
+	x := key.X.bigInt()
+	y := key.Y.bigInt()
+
+	if !curve.IsOnCurve(x, y) {
+		return nil, errors.New("square/go-jose: invalid EC key, X/Y are not on declared curve")
+	}
+
+	return &ecdsa.PublicKey{
+		Curve: curve,
+		X:     x,
+		Y:     y,
+	}, nil
+}
+
+func fromEcPublicKey(pub *ecdsa.PublicKey) (*rawJSONWebKey, error) {
+	if pub == nil || pub.X == nil || pub.Y == nil {
+		return nil, fmt.Errorf("square/go-jose: invalid EC key (nil, or X/Y missing)")
+	}
+
+	name, err := curveName(pub.Curve)
+	if err != nil {
+		return nil, err
+	}
+
+	size := curveSize(pub.Curve)
+
+	xBytes := pub.X.Bytes()
+	yBytes := pub.Y.Bytes()
+
+	if len(xBytes) > size || len(yBytes) > size {
+		return nil, fmt.Errorf("square/go-jose: invalid EC key (X/Y too large)")
+	}
+
+	key := &rawJSONWebKey{
+		Kty: "EC",
+		Crv: name,
+		X:   newFixedSizeBuffer(xBytes, size),
+		Y:   newFixedSizeBuffer(yBytes, size),
+	}
+
+	return key, nil
+}
+
+func (key rawJSONWebKey) edPrivateKey() (ed25519.PrivateKey, error) {
+	var missing []string
+	switch {
+	case key.D == nil:
+		missing = append(missing, "D")
+	case key.X == nil:
+		missing = append(missing, "X")
+	}
+
+	if len(missing) > 0 {
+		return nil, fmt.Errorf("square/go-jose: invalid Ed25519 private key, missing %s value(s)", strings.Join(missing, ", "))
+	}
+
+	privateKey := make([]byte, ed25519.PrivateKeySize)
+	copy(privateKey[0:32], key.D.bytes())
+	copy(privateKey[32:], key.X.bytes())
+	rv := ed25519.PrivateKey(privateKey)
+	return rv, nil
+}
+
+func (key rawJSONWebKey) edPublicKey() (ed25519.PublicKey, error) {
+	if key.X == nil {
+		return nil, fmt.Errorf("square/go-jose: invalid Ed key, missing x value")
+	}
+	publicKey := make([]byte, ed25519.PublicKeySize)
+	copy(publicKey[0:32], key.X.bytes())
+	rv := ed25519.PublicKey(publicKey)
+	return rv, nil
+}
+
+func (key rawJSONWebKey) rsaPrivateKey() (*rsa.PrivateKey, error) {
+	var missing []string
+	switch {
+	case key.N == nil:
+		missing = append(missing, "N")
+	case key.E == nil:
+		missing = append(missing, "E")
+	case key.D == nil:
+		missing = append(missing, "D")
+	case key.P == nil:
+		missing = append(missing, "P")
+	case key.Q == nil:
+		missing = append(missing, "Q")
+	}
+
+	if len(missing) > 0 {
+		return nil, fmt.Errorf("square/go-jose: invalid RSA private key, missing %s value(s)", strings.Join(missing, ", "))
+	}
+
+	rv := &rsa.PrivateKey{
+		PublicKey: rsa.PublicKey{
+			N: key.N.bigInt(),
+			E: key.E.toInt(),
+		},
+		D: key.D.bigInt(),
+		Primes: []*big.Int{
+			key.P.bigInt(),
+			key.Q.bigInt(),
+		},
+	}
+
+	if key.Dp != nil {
+		rv.Precomputed.Dp = key.Dp.bigInt()
+	}
+	if key.Dq != nil {
+		rv.Precomputed.Dq = key.Dq.bigInt()
+	}
+	if key.Qi != nil {
+		rv.Precomputed.Qinv = key.Qi.bigInt()
+	}
+
+	err := rv.Validate()
+	return rv, err
+}
+
+func fromEdPrivateKey(ed ed25519.PrivateKey) (*rawJSONWebKey, error) {
+	raw := fromEdPublicKey(ed25519.PublicKey(ed[32:]))
+
+	raw.D = newBuffer(ed[0:32])
+	return raw, nil
+}
+
+func fromRsaPrivateKey(rsa *rsa.PrivateKey) (*rawJSONWebKey, error) {
+	if len(rsa.Primes) != 2 {
+		return nil, ErrUnsupportedKeyType
+	}
+
+	raw := fromRsaPublicKey(&rsa.PublicKey)
+
+	raw.D = newBuffer(rsa.D.Bytes())
+	raw.P = newBuffer(rsa.Primes[0].Bytes())
+	raw.Q = newBuffer(rsa.Primes[1].Bytes())
+
+	if rsa.Precomputed.Dp != nil {
+		raw.Dp = newBuffer(rsa.Precomputed.Dp.Bytes())
+	}
+	if rsa.Precomputed.Dq != nil {
+		raw.Dq = newBuffer(rsa.Precomputed.Dq.Bytes())
+	}
+	if rsa.Precomputed.Qinv != nil {
+		raw.Qi = newBuffer(rsa.Precomputed.Qinv.Bytes())
+	}
+
+	return raw, nil
+}
+
+func (key rawJSONWebKey) ecPrivateKey() (*ecdsa.PrivateKey, error) {
+	var curve elliptic.Curve
+	switch key.Crv {
+	case "P-256":
+		curve = elliptic.P256()
+	case "P-384":
+		curve = elliptic.P384()
+	case "P-521":
+		curve = elliptic.P521()
+	default:
+		return nil, fmt.Errorf("square/go-jose: unsupported elliptic curve '%s'", key.Crv)
+	}
+
+	if key.X == nil || key.Y == nil || key.D == nil {
+		return nil, fmt.Errorf("square/go-jose: invalid EC private key, missing x/y/d values")
+	}
+
+	// The length of this octet string MUST be the full size of a coordinate for
+	// the curve specified in the "crv" parameter.
+	// https://tools.ietf.org/html/rfc7518#section-6.2.1.2
+	if curveSize(curve) != len(key.X.data) {
+		return nil, fmt.Errorf("square/go-jose: invalid EC private key, wrong length for x")
+	}
+
+	if curveSize(curve) != len(key.Y.data) {
+		return nil, fmt.Errorf("square/go-jose: invalid EC private key, wrong length for y")
+	}
+
+	// https://tools.ietf.org/html/rfc7518#section-6.2.2.1
+	if dSize(curve) != len(key.D.data) {
+		return nil, fmt.Errorf("square/go-jose: invalid EC private key, wrong length for d")
+	}
+
+	x := key.X.bigInt()
+	y := key.Y.bigInt()
+
+	if !curve.IsOnCurve(x, y) {
+		return nil, errors.New("square/go-jose: invalid EC key, X/Y are not on declared curve")
+	}
+
+	return &ecdsa.PrivateKey{
+		PublicKey: ecdsa.PublicKey{
+			Curve: curve,
+			X:     x,
+			Y:     y,
+		},
+		D: key.D.bigInt(),
+	}, nil
+}
+
+func fromEcPrivateKey(ec *ecdsa.PrivateKey) (*rawJSONWebKey, error) {
+	raw, err := fromEcPublicKey(&ec.PublicKey)
+	if err != nil {
+		return nil, err
+	}
+
+	if ec.D == nil {
+		return nil, fmt.Errorf("square/go-jose: invalid EC private key")
+	}
+
+	raw.D = newFixedSizeBuffer(ec.D.Bytes(), dSize(ec.PublicKey.Curve))
+
+	return raw, nil
+}
+
+// dSize returns the size in octets for the "d" member of an elliptic curve
+// private key.
+// The length of this octet string MUST be ceiling(log-base-2(n)/8)
+// octets (where n is the order of the curve).
+// https://tools.ietf.org/html/rfc7518#section-6.2.2.1
+func dSize(curve elliptic.Curve) int {
+	order := curve.Params().P
+	bitLen := order.BitLen()
+	size := bitLen / 8
+	if bitLen%8 != 0 {
+		size = size + 1
+	}
+	return size
+}
+
+func fromSymmetricKey(key []byte) (*rawJSONWebKey, error) {
+	return &rawJSONWebKey{
+		Kty: "oct",
+		K:   newBuffer(key),
+	}, nil
+}
+
+func (key rawJSONWebKey) symmetricKey() ([]byte, error) {
+	if key.K == nil {
+		return nil, fmt.Errorf("square/go-jose: invalid OCT (symmetric) key, missing k value")
+	}
+	return key.K.bytes(), nil
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/jwk_test.go b/vendor/gopkg.in/square/go-jose.v2/jwk_test.go
new file mode 100644
index 0000000..09ba18b
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/jwk_test.go
@@ -0,0 +1,884 @@
+/*-
+ * Copyright 2014 Square Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package jose
+
+import (
+	"bytes"
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/hex"
+	"math/big"
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"golang.org/x/crypto/ed25519"
+
+	"gopkg.in/square/go-jose.v2/json"
+)
+
+// Test chain of two X.509 certificates
+var testCertificates, _ = x509.ParseCertificates(fromBase64Bytes(`
+MIIDfDCCAmSgAwIBAgIJANWAkzF7PA8/MA0GCSqGSIb3DQEBCwUAMFUxCzAJ
+BgNVBAYTAlVTMQswCQYDVQQIEwJDQTEQMA4GA1UEChMHY2VydGlnbzEQMA4G
+A1UECxMHZXhhbXBsZTEVMBMGA1UEAxMMZXhhbXBsZS1sZWFmMB4XDTE2MDYx
+MDIyMTQxMVoXDTIzMDQxNTIyMTQxMVowVTELMAkGA1UEBhMCVVMxCzAJBgNV
+BAgTAkNBMRAwDgYDVQQKEwdjZXJ0aWdvMRAwDgYDVQQLEwdleGFtcGxlMRUw
+EwYDVQQDEwxleGFtcGxlLWxlYWYwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
+ggEKAoIBAQC7stSvfQyGuHw3v34fisqIdDXberrFoFk9ht/WdXgYzX2uLNKd
+sR/J5sbWSl8K/5djpzj31eIzqU69w8v7SChM5x9bouDsABHz3kZucx5cSafE
+gJojysBkcrq3VY+aJanzbL+qErYX+lhRpPcZK6JMWIwar8Y3B2la4yWwieec
+w2/WfEVvG0M/DOYKnR8QHFsfl3US1dnBM84czKPyt9r40gDk2XiH/lGts5a9
+4rAGvbr8IMCtq0mA5aH3Fx3mDSi3+4MZwygCAHrF5O5iSV9rEI+m2+7j2S+j
+HDUnvV+nqcpb9m6ENECnYX8FD2KcqlOjTmw8smDy09N2Np6i464lAgMBAAGj
+TzBNMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATAsBgNVHREEJTAj
+hwR/AAABhxAAAAAAAAAAAAAAAAAAAAABgglsb2NhbGhvc3QwDQYJKoZIhvcN
+AQELBQADggEBAGM4aa/qrURUweZBIwZYv8O9b2+r4l0HjGAh982/B9sMlM05
+kojyDCUGvj86z18Lm8mKr4/y+i0nJ+vDIksEvfDuzw5ALAXGcBzPJKtICUf7
+LstA/n9NNpshWz0kld9ylnB5mbUzSFDncVyeXkEf5sGQXdIIZT9ChRBoiloS
+aa7dvBVCcsX1LGP2LWqKtD+7nUnw5qCwtyAVT8pthEUxFTpywoiJS5ZdzeEx
+8MNGvUeLFj2kleqPF78EioEQlSOxViCuctEtnQuPcDLHNFr10byTZY9roObi
+qdsJLMVvb2XliJjAqaPa9AkYwGE6xHw2ispwg64Rse0+AtKups19WIUwggNT
+MIICO6ADAgECAgkAqD4tCWKt9/AwDQYJKoZIhvcNAQELBQAwVTELMAkGA1UE
+BhMCVVMxCzAJBgNVBAgTAkNBMRAwDgYDVQQKEwdjZXJ0aWdvMRAwDgYDVQQL
+EwdleGFtcGxlMRUwEwYDVQQDEwxleGFtcGxlLXJvb3QwHhcNMTYwNjEwMjIx
+NDExWhcNMjMwNDE1MjIxNDExWjBVMQswCQYDVQQGEwJVUzELMAkGA1UECBMC
+Q0ExEDAOBgNVBAoTB2NlcnRpZ28xEDAOBgNVBAsTB2V4YW1wbGUxFTATBgNV
+BAMTDGV4YW1wbGUtcm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
+ggEBAMo4ShKI2MxDz/NQVxBbz0tbD5R5NcobA0NKkaPKLyMEpnWVY9ucyauM
+joNn1F568cfOoF0pm3700U8UTPt2MMxEHIi4mFG/OF8UF+Voh1J42Tb42lRo
+W5RRR3ogh4+7QB1G94nxkYddHAJ4QMhUJlLigFg8c6Ff/MxYODy9I7ilLFOM
+Zzsjx8fFpRKRXNQFt471P/V4WTSba7GzdTOJRyTZf/xipF36n8RoEQPvyde8
+pEAsCC4oDOrEiCTdxw8rRJVAU0Wr55XX+qjxyi55C6oykIC/BWR+lUqGd7IL
+Y2Uyt/OVxllt8b+KuVKNCfn4TFlfgizLWkJRs6JV9KuwJ20CAwEAAaMmMCQw
+DgYDVR0PAQH/BAQDAgIEMBIGA1UdEwEB/wQIMAYBAf8CAQAwDQYJKoZIhvcN
+AQELBQADggEBAIsQlTrm9NT6gts0cs4JHp8AutuMrvGyLpIUOlJcEybvgxaz
+LebIMGZek5w3yEJiCyCK9RdNDP3Kdc/+nM6PhvzfPOVo58+0tMCYyEpZVXhD
+zmasNDP4fMbiUpczvx5OwPw/KuhwD+1ITuZUQnQlqXgTYoj9n39+qlgUsHos
+WXHmfzd6Fcz96ADSXg54IL2cEoJ41Q3ewhA7zmWWPLMAl21aex2haiAmzqqN
+xXyfZTnGNnE3lkV1yVguOrqDZyMRdcxDFvxvtmEeMtYV2Mc/zlS9ccrcOkrc
+mZSDxthLu3UMl98NA2NrCGWwzJwpk36vQ0PRSbibsCMarFspP8zbIoU=`))
+
+func TestCurveSize(t *testing.T) {
+	size256 := curveSize(elliptic.P256())
+	size384 := curveSize(elliptic.P384())
+	size521 := curveSize(elliptic.P521())
+	if size256 != 32 {
+		t.Error("P-256 have 32 bytes")
+	}
+	if size384 != 48 {
+		t.Error("P-384 have 48 bytes")
+	}
+	if size521 != 66 {
+		t.Error("P-521 have 66 bytes")
+	}
+}
+
+func TestRoundtripRsaPrivate(t *testing.T) {
+	jwk, err := fromRsaPrivateKey(rsaTestKey)
+	if err != nil {
+		t.Error("problem constructing JWK from rsa key", err)
+	}
+
+	rsa2, err := jwk.rsaPrivateKey()
+	if err != nil {
+		t.Error("problem converting RSA private -> JWK", err)
+	}
+
+	if rsa2.N.Cmp(rsaTestKey.N) != 0 {
+		t.Error("RSA private N mismatch")
+	}
+	if rsa2.E != rsaTestKey.E {
+		t.Error("RSA private E mismatch")
+	}
+	if rsa2.D.Cmp(rsaTestKey.D) != 0 {
+		t.Error("RSA private D mismatch")
+	}
+	if len(rsa2.Primes) != 2 {
+		t.Error("RSA private roundtrip expected two primes")
+	}
+	if rsa2.Primes[0].Cmp(rsaTestKey.Primes[0]) != 0 {
+		t.Error("RSA private P mismatch")
+	}
+	if rsa2.Primes[1].Cmp(rsaTestKey.Primes[1]) != 0 {
+		t.Error("RSA private Q mismatch")
+	}
+}
+
+func TestRoundtripRsaPrivatePrecomputed(t *testing.T) {
+	// Isolate a shallow copy of the rsaTestKey to avoid polluting it with Precompute
+	localKey := &(*rsaTestKey)
+	localKey.Precompute()
+
+	jwk, err := fromRsaPrivateKey(localKey)
+	if err != nil {
+		t.Error("problem constructing JWK from rsa key", err)
+	}
+
+	rsa2, err := jwk.rsaPrivateKey()
+	if err != nil {
+		t.Error("problem converting RSA private -> JWK", err)
+	}
+
+	if rsa2.Precomputed.Dp == nil {
+		t.Error("RSA private Dp nil")
+	}
+	if rsa2.Precomputed.Dq == nil {
+		t.Error("RSA private Dq nil")
+	}
+	if rsa2.Precomputed.Qinv == nil {
+		t.Error("RSA private Qinv nil")
+	}
+
+	if rsa2.Precomputed.Dp.Cmp(localKey.Precomputed.Dp) != 0 {
+		t.Error("RSA private Dp mismatch")
+	}
+	if rsa2.Precomputed.Dq.Cmp(localKey.Precomputed.Dq) != 0 {
+		t.Error("RSA private Dq mismatch")
+	}
+	if rsa2.Precomputed.Qinv.Cmp(localKey.Precomputed.Qinv) != 0 {
+		t.Error("RSA private Qinv mismatch")
+	}
+}
+
+func TestRsaPrivateInsufficientPrimes(t *testing.T) {
+	brokenRsaPrivateKey := rsa.PrivateKey{
+		PublicKey: rsa.PublicKey{
+			N: rsaTestKey.N,
+			E: rsaTestKey.E,
+		},
+		D:      rsaTestKey.D,
+		Primes: []*big.Int{rsaTestKey.Primes[0]},
+	}
+
+	_, err := fromRsaPrivateKey(&brokenRsaPrivateKey)
+	if err != ErrUnsupportedKeyType {
+		t.Error("expected unsupported key type error, got", err)
+	}
+}
+
+func TestRsaPrivateExcessPrimes(t *testing.T) {
+	brokenRsaPrivateKey := rsa.PrivateKey{
+		PublicKey: rsa.PublicKey{
+			N: rsaTestKey.N,
+			E: rsaTestKey.E,
+		},
+		D: rsaTestKey.D,
+		Primes: []*big.Int{
+			rsaTestKey.Primes[0],
+			rsaTestKey.Primes[1],
+			big.NewInt(3),
+		},
+	}
+
+	_, err := fromRsaPrivateKey(&brokenRsaPrivateKey)
+	if err != ErrUnsupportedKeyType {
+		t.Error("expected unsupported key type error, got", err)
+	}
+}
+
+func TestRoundtripEcPublic(t *testing.T) {
+	for i, ecTestKey := range []*ecdsa.PrivateKey{ecTestKey256, ecTestKey384, ecTestKey521} {
+		jwk, err := fromEcPublicKey(&ecTestKey.PublicKey)
+
+		ec2, err := jwk.ecPublicKey()
+		if err != nil {
+			t.Error("problem converting ECDSA private -> JWK", i, err)
+		}
+
+		if !reflect.DeepEqual(ec2.Curve, ecTestKey.Curve) {
+			t.Error("ECDSA private curve mismatch", i)
+		}
+		if ec2.X.Cmp(ecTestKey.X) != 0 {
+			t.Error("ECDSA X mismatch", i)
+		}
+		if ec2.Y.Cmp(ecTestKey.Y) != 0 {
+			t.Error("ECDSA Y mismatch", i)
+		}
+	}
+}
+
+func TestRoundtripEcPrivate(t *testing.T) {
+	for i, ecTestKey := range []*ecdsa.PrivateKey{ecTestKey256, ecTestKey384, ecTestKey521} {
+		jwk, err := fromEcPrivateKey(ecTestKey)
+
+		ec2, err := jwk.ecPrivateKey()
+		if err != nil {
+			t.Fatalf("problem converting ECDSA private -> JWK for %#v: %s", ecTestKey, err)
+		}
+
+		if !reflect.DeepEqual(ec2.Curve, ecTestKey.Curve) {
+			t.Error("ECDSA private curve mismatch", i)
+		}
+		if ec2.X.Cmp(ecTestKey.X) != 0 {
+			t.Error("ECDSA X mismatch", i)
+		}
+		if ec2.Y.Cmp(ecTestKey.Y) != 0 {
+			t.Error("ECDSA Y mismatch", i)
+		}
+		if ec2.D.Cmp(ecTestKey.D) != 0 {
+			t.Error("ECDSA D mismatch", i)
+		}
+	}
+}
+
+func TestRoundtripX5C(t *testing.T) {
+	jwk := JSONWebKey{
+		Key:          rsaTestKey,
+		KeyID:        "bar",
+		Algorithm:    "foo",
+		Certificates: testCertificates,
+	}
+
+	jsonbar, err := jwk.MarshalJSON()
+	if err != nil {
+		t.Error("problem marshaling", err)
+	}
+
+	var jwk2 JSONWebKey
+	err = jwk2.UnmarshalJSON(jsonbar)
+	if err != nil {
+		t.Fatal("problem unmarshalling", err)
+	}
+
+	if !reflect.DeepEqual(testCertificates, jwk2.Certificates) {
+		t.Error("Certificates not equal", jwk.Certificates, jwk2.Certificates)
+	}
+
+	jsonbar2, err := jwk2.MarshalJSON()
+	if err != nil {
+		t.Error("problem marshaling", err)
+	}
+	if !bytes.Equal(jsonbar, jsonbar2) {
+		t.Error("roundtrip should not lose information")
+	}
+}
+
+func TestMarshalUnmarshal(t *testing.T) {
+	kid := "DEADBEEF"
+
+	for i, key := range []interface{}{ecTestKey256, ecTestKey384, ecTestKey521, rsaTestKey, ed25519PrivateKey} {
+		for _, use := range []string{"", "sig", "enc"} {
+			jwk := JSONWebKey{Key: key, KeyID: kid, Algorithm: "foo"}
+			if use != "" {
+				jwk.Use = use
+			}
+
+			jsonbar, err := jwk.MarshalJSON()
+			if err != nil {
+				t.Error("problem marshaling", i, err)
+			}
+
+			var jwk2 JSONWebKey
+			err = jwk2.UnmarshalJSON(jsonbar)
+			if err != nil {
+				t.Fatal("problem unmarshalling", i, err)
+			}
+
+			jsonbar2, err := jwk2.MarshalJSON()
+			if err != nil {
+				t.Fatal("problem marshaling", i, err)
+			}
+
+			if !bytes.Equal(jsonbar, jsonbar2) {
+				t.Error("roundtrip should not lose information", i)
+			}
+			if jwk2.KeyID != kid {
+				t.Error("kid did not roundtrip JSON marshalling", i)
+			}
+
+			if jwk2.Algorithm != "foo" {
+				t.Error("alg did not roundtrip JSON marshalling", i)
+			}
+
+			if jwk2.Use != use {
+				t.Error("use did not roundtrip JSON marshalling", i)
+			}
+		}
+	}
+}
+
+func TestMarshalNonPointer(t *testing.T) {
+	type EmbedsKey struct {
+		Key JSONWebKey
+	}
+
+	keyJSON := []byte(`{
+		"e": "AQAB",
+		"kty": "RSA",
+		"n": "vd7rZIoTLEe-z1_8G1FcXSw9CQFEJgV4g9V277sER7yx5Qjz_Pkf2YVth6wwwFJEmzc0hoKY-MMYFNwBE4hQHw"
+	}`)
+	var parsedKey JSONWebKey
+	err := json.Unmarshal(keyJSON, &parsedKey)
+	if err != nil {
+		t.Errorf("Error unmarshalling key: %v", err)
+		return
+	}
+	ek := EmbedsKey{
+		Key: parsedKey,
+	}
+	out, err := json.Marshal(ek)
+	if err != nil {
+		t.Errorf("Error marshalling JSON: %v", err)
+		return
+	}
+	expected := "{\"Key\":{\"kty\":\"RSA\",\"n\":\"vd7rZIoTLEe-z1_8G1FcXSw9CQFEJgV4g9V277sER7yx5Qjz_Pkf2YVth6wwwFJEmzc0hoKY-MMYFNwBE4hQHw\",\"e\":\"AQAB\"}}"
+	if string(out) != expected {
+		t.Error("Failed to marshal embedded non-pointer JWK properly:", string(out))
+	}
+}
+
+func TestMarshalUnmarshalInvalid(t *testing.T) {
+	// Make an invalid curve coordinate by creating a byte array that is one
+	// byte too large, and setting the first byte to 1 (otherwise it's just zero).
+	invalidCoord := make([]byte, curveSize(ecTestKey256.Curve)+1)
+	invalidCoord[0] = 1
+
+	keys := []interface{}{
+		// Empty keys
+		&rsa.PrivateKey{},
+		&ecdsa.PrivateKey{},
+		// Invalid keys
+		&ecdsa.PrivateKey{
+			PublicKey: ecdsa.PublicKey{
+				// Missing values in pub key
+				Curve: elliptic.P256(),
+			},
+		},
+		&ecdsa.PrivateKey{
+			PublicKey: ecdsa.PublicKey{
+				// Invalid curve
+				Curve: nil,
+				X:     ecTestKey256.X,
+				Y:     ecTestKey256.Y,
+			},
+		},
+		&ecdsa.PrivateKey{
+			// Valid pub key, but missing priv key values
+			PublicKey: ecTestKey256.PublicKey,
+		},
+		&ecdsa.PrivateKey{
+			// Invalid pub key, values too large
+			PublicKey: ecdsa.PublicKey{
+				Curve: ecTestKey256.Curve,
+				X:     big.NewInt(0).SetBytes(invalidCoord),
+				Y:     big.NewInt(0).SetBytes(invalidCoord),
+			},
+			D: ecTestKey256.D,
+		},
+		nil,
+	}
+
+	for i, key := range keys {
+		jwk := JSONWebKey{Key: key}
+		_, err := jwk.MarshalJSON()
+		if err == nil {
+			t.Error("managed to serialize invalid key", i)
+		}
+	}
+}
+
+func TestWebKeyVectorsInvalid(t *testing.T) {
+	keys := []string{
+		// Invalid JSON
+		"{X",
+		// Empty key
+		"{}",
+		// Invalid RSA keys
+		`{"kty":"RSA"}`,
+		`{"kty":"RSA","e":""}`,
+		`{"kty":"RSA","e":"XXXX"}`,
+		`{"kty":"RSA","d":"XXXX"}`,
+		// Invalid EC keys
+		`{"kty":"EC","crv":"ABC"}`,
+		`{"kty":"EC","crv":"P-256"}`,
+		`{"kty":"EC","crv":"P-256","d":"XXX"}`,
+		`{"kty":"EC","crv":"ABC","d":"dGVzdA","x":"dGVzdA"}`,
+		`{"kty":"EC","crv":"P-256","d":"dGVzdA","x":"dGVzdA"}`,
+	}
+
+	for _, key := range keys {
+		var jwk2 JSONWebKey
+		err := jwk2.UnmarshalJSON([]byte(key))
+		if err == nil {
+			t.Error("managed to parse invalid key:", key)
+		}
+	}
+}
+
+// Test vectors from RFC 7520
+var cookbookJWKs = []string{
+	// EC Public
+	stripWhitespace(`{
+     "kty": "EC",
+     "kid": "bilbo.baggins@hobbiton.example",
+     "use": "sig",
+     "crv": "P-521",
+     "x": "AHKZLLOsCOzz5cY97ewNUajB957y-C-U88c3v13nmGZx6sYl_oJXu9
+         A5RkTKqjqvjyekWF-7ytDyRXYgCF5cj0Kt",
+     "y": "AdymlHvOiLxXkEhayXQnNCvDX4h9htZaCJN34kfmC6pV5OhQHiraVy
+         SsUdaQkAgDPrwQrJmbnX9cwlGfP-HqHZR1"
+   }`),
+
+	//ED Private
+	stripWhitespace(`{
+     "kty": "OKP",
+     "crv": "Ed25519",
+     "x": "11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo",
+     "d": "nWGxne_9WmC6hEr0kuwsxERJxWl7MmkZcDusAxyuf2A"
+   }`),
+
+	// EC Private
+	stripWhitespace(`{
+     "kty": "EC",
+     "kid": "bilbo.baggins@hobbiton.example",
+     "use": "sig",
+     "crv": "P-521",
+     "x": "AHKZLLOsCOzz5cY97ewNUajB957y-C-U88c3v13nmGZx6sYl_oJXu9
+           A5RkTKqjqvjyekWF-7ytDyRXYgCF5cj0Kt",
+     "y": "AdymlHvOiLxXkEhayXQnNCvDX4h9htZaCJN34kfmC6pV5OhQHiraVy
+           SsUdaQkAgDPrwQrJmbnX9cwlGfP-HqHZR1",
+     "d": "AAhRON2r9cqXX1hg-RoI6R1tX5p2rUAYdmpHZoC1XNM56KtscrX6zb
+           KipQrCW9CGZH3T4ubpnoTKLDYJ_fF3_rJt"
+   }`),
+
+	// RSA Public
+	stripWhitespace(`{
+     "kty": "RSA",
+     "kid": "bilbo.baggins@hobbiton.example",
+     "use": "sig",
+     "n": "n4EPtAOCc9AlkeQHPzHStgAbgs7bTZLwUBZdR8_KuKPEHLd4rHVTeT
+         -O-XV2jRojdNhxJWTDvNd7nqQ0VEiZQHz_AJmSCpMaJMRBSFKrKb2wqV
+         wGU_NsYOYL-QtiWN2lbzcEe6XC0dApr5ydQLrHqkHHig3RBordaZ6Aj-
+         oBHqFEHYpPe7Tpe-OfVfHd1E6cS6M1FZcD1NNLYD5lFHpPI9bTwJlsde
+         3uhGqC0ZCuEHg8lhzwOHrtIQbS0FVbb9k3-tVTU4fg_3L_vniUFAKwuC
+         LqKnS2BYwdq_mzSnbLY7h_qixoR7jig3__kRhuaxwUkRz5iaiQkqgc5g
+         HdrNP5zw",
+     "e": "AQAB"
+   }`),
+
+	// RSA Private
+	stripWhitespace(`{"kty":"RSA",
+      "kid":"juliet@capulet.lit",
+      "use":"enc",
+      "n":"t6Q8PWSi1dkJj9hTP8hNYFlvadM7DflW9mWepOJhJ66w7nyoK1gPNqFMSQRy
+           O125Gp-TEkodhWr0iujjHVx7BcV0llS4w5ACGgPrcAd6ZcSR0-Iqom-QFcNP
+           8Sjg086MwoqQU_LYywlAGZ21WSdS_PERyGFiNnj3QQlO8Yns5jCtLCRwLHL0
+           Pb1fEv45AuRIuUfVcPySBWYnDyGxvjYGDSM-AqWS9zIQ2ZilgT-GqUmipg0X
+           OC0Cc20rgLe2ymLHjpHciCKVAbY5-L32-lSeZO-Os6U15_aXrk9Gw8cPUaX1
+           _I8sLGuSiVdt3C_Fn2PZ3Z8i744FPFGGcG1qs2Wz-Q",
+      "e":"AQAB",
+      "d":"GRtbIQmhOZtyszfgKdg4u_N-R_mZGU_9k7JQ_jn1DnfTuMdSNprTeaSTyWfS
+           NkuaAwnOEbIQVy1IQbWVV25NY3ybc_IhUJtfri7bAXYEReWaCl3hdlPKXy9U
+           vqPYGR0kIXTQRqns-dVJ7jahlI7LyckrpTmrM8dWBo4_PMaenNnPiQgO0xnu
+           ToxutRZJfJvG4Ox4ka3GORQd9CsCZ2vsUDmsXOfUENOyMqADC6p1M3h33tsu
+           rY15k9qMSpG9OX_IJAXmxzAh_tWiZOwk2K4yxH9tS3Lq1yX8C1EWmeRDkK2a
+           hecG85-oLKQt5VEpWHKmjOi_gJSdSgqcN96X52esAQ",
+      "p":"2rnSOV4hKSN8sS4CgcQHFbs08XboFDqKum3sc4h3GRxrTmQdl1ZK9uw-PIHf
+           QP0FkxXVrx-WE-ZEbrqivH_2iCLUS7wAl6XvARt1KkIaUxPPSYB9yk31s0Q8
+           UK96E3_OrADAYtAJs-M3JxCLfNgqh56HDnETTQhH3rCT5T3yJws",
+      "q":"1u_RiFDP7LBYh3N4GXLT9OpSKYP0uQZyiaZwBtOCBNJgQxaj10RWjsZu0c6I
+           edis4S7B_coSKB0Kj9PaPaBzg-IySRvvcQuPamQu66riMhjVtG6TlV8CLCYK
+           rYl52ziqK0E_ym2QnkwsUX7eYTB7LbAHRK9GqocDE5B0f808I4s",
+      "dp":"KkMTWqBUefVwZ2_Dbj1pPQqyHSHjj90L5x_MOzqYAJMcLMZtbUtwKqvVDq3
+           tbEo3ZIcohbDtt6SbfmWzggabpQxNxuBpoOOf_a_HgMXK_lhqigI4y_kqS1w
+           Y52IwjUn5rgRrJ-yYo1h41KR-vz2pYhEAeYrhttWtxVqLCRViD6c",
+      "dq":"AvfS0-gRxvn0bwJoMSnFxYcK1WnuEjQFluMGfwGitQBWtfZ1Er7t1xDkbN9
+           GQTB9yqpDoYaN06H7CFtrkxhJIBQaj6nkF5KKS3TQtQ5qCzkOkmxIe3KRbBy
+           mXxkb5qwUpX5ELD5xFc6FeiafWYY63TmmEAu_lRFCOJ3xDea-ots",
+      "qi":"lSQi-w9CpyUReMErP1RsBLk7wNtOvs5EQpPqmuMvqW57NBUczScEoPwmUqq
+           abu9V0-Py4dQ57_bapoKRu1R90bvuFnU63SHWEFglZQvJDMeAvmj4sm-Fp0o
+           Yu_neotgQ0hzbI5gry7ajdYy9-2lNx_76aBZoOUu9HCJ-UsfSOI8"}`),
+
+	// X.509 Certificate Chain
+	stripWhitespace(`{"kty":"RSA",
+      "use":"sig",
+      "kid":"1b94c",
+      "n":"vrjOfz9Ccdgx5nQudyhdoR17V-IubWMeOZCwX_jj0hgAsz2J_pqYW08
+           PLbK_PdiVGKPrqzmDIsLI7sA25VEnHU1uCLNwBuUiCO11_-7dYbsr4iJmG0Q
+           u2j8DsVyT1azpJC_NG84Ty5KKthuCaPod7iI7w0LK9orSMhBEwwZDCxTWq4a
+           YWAchc8t-emd9qOvWtVMDC2BXksRngh6X5bUYLy6AyHKvj-nUy1wgzjYQDwH
+           MTplCoLtU-o-8SNnZ1tmRoGE9uJkBLdh5gFENabWnU5m1ZqZPdwS-qo-meMv
+           VfJb6jJVWRpl2SUtCnYG2C32qvbWbjZ_jBPD5eunqsIo1vQ",
+      "e":"AQAB",
+      "x5c":
+           ["MIIDQjCCAiqgAwIBAgIGATz/FuLiMA0GCSqGSIb3DQEBBQUAMGIxCzAJB
+           gNVBAYTAlVTMQswCQYDVQQIEwJDTzEPMA0GA1UEBxMGRGVudmVyMRwwGgYD
+           VQQKExNQaW5nIElkZW50aXR5IENvcnAuMRcwFQYDVQQDEw5CcmlhbiBDYW1
+           wYmVsbDAeFw0xMzAyMjEyMzI5MTVaFw0xODA4MTQyMjI5MTVaMGIxCzAJBg
+           NVBAYTAlVTMQswCQYDVQQIEwJDTzEPMA0GA1UEBxMGRGVudmVyMRwwGgYDV
+           QQKExNQaW5nIElkZW50aXR5IENvcnAuMRcwFQYDVQQDEw5CcmlhbiBDYW1w
+           YmVsbDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL64zn8/QnH
+           YMeZ0LncoXaEde1fiLm1jHjmQsF/449IYALM9if6amFtPDy2yvz3YlRij66
+           s5gyLCyO7ANuVRJx1NbgizcAblIgjtdf/u3WG7K+IiZhtELto/A7Fck9Ws6
+           SQvzRvOE8uSirYbgmj6He4iO8NCyvaK0jIQRMMGQwsU1quGmFgHIXPLfnpn
+           fajr1rVTAwtgV5LEZ4Iel+W1GC8ugMhyr4/p1MtcIM42EA8BzE6ZQqC7VPq
+           PvEjZ2dbZkaBhPbiZAS3YeYBRDWm1p1OZtWamT3cEvqqPpnjL1XyW+oyVVk
+           aZdklLQp2Btgt9qr21m42f4wTw+Xrp6rCKNb0CAwEAATANBgkqhkiG9w0BA
+           QUFAAOCAQEAh8zGlfSlcI0o3rYDPBB07aXNswb4ECNIKG0CETTUxmXl9KUL
+           +9gGlqCz5iWLOgWsnrcKcY0vXPG9J1r9AqBNTqNgHq2G03X09266X5CpOe1
+           zFo+Owb1zxtp3PehFdfQJ610CDLEaS9V9Rqp17hCyybEpOGVwe8fnk+fbEL
+           2Bo3UPGrpsHzUoaGpDftmWssZkhpBJKVMJyf/RuP2SmmaIzmnw9JiSlYhzo
+           4tpzd5rFXhjRbg4zW9C+2qok+2+qDM1iJ684gPHMIY8aLWrdgQTxkumGmTq
+           gawR+N5MDtdPTEQ0XfIBc2cJEUyMTY5MPvACWpkA6SdS4xSvdXK3IVfOWA=="]}`),
+}
+
+// SHA-256 thumbprints of the above keys, hex-encoded
+var cookbookJWKThumbprints = []string{
+	"747ae2dd2003664aeeb21e4753fe7402846170a16bc8df8f23a8cf06d3cbe793",
+	"f6934029a341ddf81dceb753e91d17efe16664f40d9f4ed84bc5ea87e111f29d",
+	"747ae2dd2003664aeeb21e4753fe7402846170a16bc8df8f23a8cf06d3cbe793",
+	"f63838e96077ad1fc01c3f8405774dedc0641f558ebb4b40dccf5f9b6d66a932",
+	"0fc478f8579325fcee0d4cbc6d9d1ce21730a6e97e435d6008fb379b0ebe47d4",
+	"0ddb05bfedbec2070fa037324ba397396561d3425d6d69245570c261dc49dee3",
+}
+
+func TestWebKeyVectorsValid(t *testing.T) {
+	for _, key := range cookbookJWKs {
+		var jwk2 JSONWebKey
+		err := jwk2.UnmarshalJSON([]byte(key))
+		if err != nil {
+			t.Error("unable to parse valid key:", key, err)
+		}
+	}
+}
+
+func TestEd25519Serialization(t *testing.T) {
+	jwk := JSONWebKey{
+		Key: ed25519PrivateKey,
+	}
+	serialized, _ := json.Marshal(jwk)
+
+	var jwk2 JSONWebKey
+	json.Unmarshal(serialized, &jwk2)
+
+	assert.True(t, bytes.Equal(
+		[]byte(jwk.Key.(ed25519.PrivateKey).Public().(ed25519.PublicKey)),
+		[]byte(jwk2.Key.(ed25519.PrivateKey).Public().(ed25519.PublicKey))))
+}
+
+func TestThumbprint(t *testing.T) {
+	for i, key := range cookbookJWKs {
+		var jwk2 JSONWebKey
+		err := jwk2.UnmarshalJSON([]byte(key))
+		if err != nil {
+			t.Error("unable to parse valid key:", key, err)
+		}
+
+		tp, err := jwk2.Thumbprint(crypto.SHA256)
+		if err != nil {
+			t.Error("unable to compute thumbprint:", key, err)
+		}
+
+		tpHex := hex.EncodeToString(tp)
+		if cookbookJWKThumbprints[i] != tpHex {
+			t.Error("incorrect thumbprint:", i, cookbookJWKThumbprints[i], tpHex)
+		}
+	}
+}
+
+func TestMarshalUnmarshalJWKSet(t *testing.T) {
+	jwk1 := JSONWebKey{Key: rsaTestKey, KeyID: "ABCDEFG", Algorithm: "foo"}
+	jwk2 := JSONWebKey{Key: rsaTestKey, KeyID: "GFEDCBA", Algorithm: "foo"}
+	var set JSONWebKeySet
+	set.Keys = append(set.Keys, jwk1)
+	set.Keys = append(set.Keys, jwk2)
+
+	jsonbar, err := json.Marshal(&set)
+	if err != nil {
+		t.Error("problem marshalling set", err)
+	}
+	var set2 JSONWebKeySet
+	err = json.Unmarshal(jsonbar, &set2)
+	if err != nil {
+		t.Fatal("problem unmarshalling set", err)
+	}
+	jsonbar2, err := json.Marshal(&set2)
+	if err != nil {
+		t.Fatal("problem marshalling set", err)
+	}
+	if !bytes.Equal(jsonbar, jsonbar2) {
+		t.Error("roundtrip should not lose information")
+	}
+}
+
+func TestJWKSetKey(t *testing.T) {
+	jwk1 := JSONWebKey{Key: rsaTestKey, KeyID: "ABCDEFG", Algorithm: "foo"}
+	jwk2 := JSONWebKey{Key: rsaTestKey, KeyID: "GFEDCBA", Algorithm: "foo"}
+	var set JSONWebKeySet
+	set.Keys = append(set.Keys, jwk1)
+	set.Keys = append(set.Keys, jwk2)
+	k := set.Key("ABCDEFG")
+	if len(k) != 1 {
+		t.Errorf("method should return slice with one key not %d", len(k))
+	}
+	if k[0].KeyID != "ABCDEFG" {
+		t.Error("method should return key with ID ABCDEFG")
+	}
+}
+
+func TestJWKSymmetricKey(t *testing.T) {
+	sample1 := `{"kty":"oct","alg":"A128KW","k":"GawgguFyGrWKav7AX4VKUg"}`
+	sample2 := `{"kty":"oct","k":"AyM1SysPpbyDfgZld3umj1qzKObwVMkoqQ-EstJQLr_T-1qS0gZH75aKtMN3Yj0iPS4hcgUuTwjAzZr1Z9CAow","kid":"HMAC key used in JWS spec Appendix A.1 example"}`
+
+	var jwk1 JSONWebKey
+	json.Unmarshal([]byte(sample1), &jwk1)
+
+	if jwk1.Algorithm != "A128KW" {
+		t.Errorf("expected Algorithm to be A128KW, but was '%s'", jwk1.Algorithm)
+	}
+	expected1 := fromHexBytes("19ac2082e1721ab58a6afec05f854a52")
+	if !bytes.Equal(jwk1.Key.([]byte), expected1) {
+		t.Errorf("expected Key to be '%s', but was '%s'", hex.EncodeToString(expected1), hex.EncodeToString(jwk1.Key.([]byte)))
+	}
+
+	var jwk2 JSONWebKey
+	json.Unmarshal([]byte(sample2), &jwk2)
+
+	if jwk2.KeyID != "HMAC key used in JWS spec Appendix A.1 example" {
+		t.Errorf("expected KeyID to be 'HMAC key used in JWS spec Appendix A.1 example', but was '%s'", jwk2.KeyID)
+	}
+	expected2 := fromHexBytes(`
+    0323354b2b0fa5bc837e0665777ba68f5ab328e6f054c928a90f84b2d2502ebf
+    d3fb5a92d20647ef968ab4c377623d223d2e2172052e4f08c0cd9af567d080a3`)
+	if !bytes.Equal(jwk2.Key.([]byte), expected2) {
+		t.Errorf("expected Key to be '%s', but was '%s'", hex.EncodeToString(expected2), hex.EncodeToString(jwk2.Key.([]byte)))
+	}
+}
+
+func TestJWKSymmetricRoundtrip(t *testing.T) {
+	jwk1 := JSONWebKey{Key: []byte{1, 2, 3, 4}}
+	marshaled, err := jwk1.MarshalJSON()
+	if err != nil {
+		t.Error("failed to marshal valid JWK object", err)
+	}
+
+	var jwk2 JSONWebKey
+	err = jwk2.UnmarshalJSON(marshaled)
+	if err != nil {
+		t.Error("failed to unmarshal valid JWK object", err)
+	}
+
+	if !bytes.Equal(jwk1.Key.([]byte), jwk2.Key.([]byte)) {
+		t.Error("round-trip of symmetric JWK gave different raw keys")
+	}
+}
+
+func TestJWKSymmetricInvalid(t *testing.T) {
+	invalid := JSONWebKey{}
+	_, err := invalid.MarshalJSON()
+	if err == nil {
+		t.Error("excepted error on marshaling invalid symmetric JWK object")
+	}
+
+	var jwk JSONWebKey
+	err = jwk.UnmarshalJSON([]byte(`{"kty":"oct"}`))
+	if err == nil {
+		t.Error("excepted error on unmarshaling invalid symmetric JWK object")
+	}
+}
+
+func TestJWKIsPublic(t *testing.T) {
+	bigInt := big.NewInt(0)
+	eccPub := ecdsa.PublicKey{elliptic.P256(), bigInt, bigInt}
+	rsaPub := rsa.PublicKey{bigInt, 1}
+
+	cases := []struct {
+		key              interface{}
+		expectedIsPublic bool
+	}{
+		{&eccPub, true},
+		{&ecdsa.PrivateKey{eccPub, bigInt}, false},
+		{&rsaPub, true},
+		{&rsa.PrivateKey{rsaPub, bigInt, []*big.Int{bigInt, bigInt}, rsa.PrecomputedValues{}}, false},
+		{ed25519PublicKey, true},
+		{ed25519PrivateKey, false},
+	}
+
+	for _, tc := range cases {
+		k := &JSONWebKey{Key: tc.key}
+		if public := k.IsPublic(); public != tc.expectedIsPublic {
+			t.Errorf("expected IsPublic to return %t, got %t", tc.expectedIsPublic, public)
+		}
+	}
+}
+
+func TestJWKValid(t *testing.T) {
+	bigInt := big.NewInt(0)
+	eccPub := ecdsa.PublicKey{elliptic.P256(), bigInt, bigInt}
+	rsaPub := rsa.PublicKey{bigInt, 1}
+	edPubEmpty := ed25519.PublicKey([]byte{})
+	edPrivEmpty := ed25519.PublicKey([]byte{})
+
+	cases := []struct {
+		key              interface{}
+		expectedValidity bool
+	}{
+		{nil, false},
+		{&ecdsa.PublicKey{}, false},
+		{&eccPub, true},
+		{&ecdsa.PrivateKey{}, false},
+		{&ecdsa.PrivateKey{eccPub, bigInt}, true},
+		{&rsa.PublicKey{}, false},
+		{&rsaPub, true},
+		{&rsa.PrivateKey{}, false},
+		{&rsa.PrivateKey{rsaPub, bigInt, []*big.Int{bigInt, bigInt}, rsa.PrecomputedValues{}}, true},
+		{ed25519PublicKey, true},
+		{ed25519PrivateKey, true},
+		{edPubEmpty, false},
+		{edPrivEmpty, false},
+	}
+
+	for _, tc := range cases {
+		k := &JSONWebKey{Key: tc.key}
+		valid := k.Valid()
+		if valid != tc.expectedValidity {
+			t.Errorf("expected Valid to return %t, got %t", tc.expectedValidity, valid)
+		}
+		if valid {
+			wasPublic := k.IsPublic()
+			p := k.Public() // all aforemention keys are asymmetric
+			if !p.Valid() {
+				t.Errorf("unable to derive public key from valid asymmetric key")
+			}
+			if wasPublic != k.IsPublic() {
+				t.Errorf("original key was touched during public key derivation")
+			}
+		}
+	}
+}
+
+func TestJWKBufferSizeCheck(t *testing.T) {
+	key := `{
+		"kty":"EC",
+		"crv":"P-256",
+		"x":"m9GSmJ5iGmAYlMlaOJGSFN_CjN9cIn8GGYExP-C0FBiIXlWTNvGN38R9WdrHcppfsKF0FXMOMyutpHIRaiMxYSA",
+		"y":"ZaPcRZ3q_7T3h-Gwz2i-T2JjJXfj6YVGgKHcFz5zqmg"}`
+	var jwk JSONWebKey
+	jwk.UnmarshalJSON([]byte(key))
+	jwk.Valid() // true
+	// panic: square/go-jose: invalid call to newFixedSizeBuffer (len(data) > length)
+	// github.com/square/go-jose.newFixedSizeBuffer(0xc420014557, 0x41, 0x41, 0x20, 0x0)
+	jwk.Thumbprint(crypto.SHA256)
+}
+
+func TestJWKPaddingPrivateX(t *testing.T) {
+	key := `{
+    "kty": "EC",
+    "crv": "P-256",
+    "x": "nPTIABcDASY6FNGSNfHCB51tY7qChtgzeVazOtLrwQ",
+    "y": "vEEs4V0egJkNyM2Q4pp001zu14VcpQ0_Ei8xOOPxKZs",
+    "d": "nIVCvMR2wkLmeGJErOpI23VDHl2s3JwGdbzKy0odir0"
+  }`
+	var jwk JSONWebKey
+	err := jwk.UnmarshalJSON([]byte(key))
+	if err == nil {
+		t.Errorf("Expected key with short x to fail unmarshalling")
+	}
+	if !strings.Contains(err.Error(), "wrong length for x") {
+		t.Errorf("Wrong error for short x, got %q", err)
+	}
+	if jwk.Valid() {
+		t.Errorf("Expected key to be invalid, but it was valid.")
+	}
+}
+
+func TestJWKPaddingPrivateY(t *testing.T) {
+	key := `{
+    "kty": "EC",
+    "crv": "P-256",
+    "x": "vEEs4V0egJkNyM2Q4pp001zu14VcpQ0_Ei8xOOPxKZs",
+    "y": "nPTIABcDASY6FNGSNfHCB51tY7qChtgzeVazOtLrwQ",
+    "d": "nIVCvMR2wkLmeGJErOpI23VDHl2s3JwGdbzKy0odir0"
+  }`
+	var jwk JSONWebKey
+	err := jwk.UnmarshalJSON([]byte(key))
+	if err == nil {
+		t.Errorf("Expected key with short x to fail unmarshalling")
+	}
+	if !strings.Contains(err.Error(), "wrong length for y") {
+		t.Errorf("Wrong error for short y, got %q", err)
+	}
+	if jwk.Valid() {
+		t.Errorf("Expected key to be invalid, but it was valid.")
+	}
+}
+
+func TestJWKPaddingPrivateD(t *testing.T) {
+	key := `{
+    "kty": "EC",
+    "crv": "P-256",
+    "x": "vEEs4V0egJkNyM2Q4pp001zu14VcpQ0_Ei8xOOPxKZs",
+    "y": "qnPTIABcDASY6FNGSNfHCB51tY7qChtgzeVazOtLrwQ",
+    "d": "IVCvMR2wkLmeGJErOpI23VDHl2s3JwGdbzKy0odir0"
+  }`
+	var jwk JSONWebKey
+	err := jwk.UnmarshalJSON([]byte(key))
+	if err == nil {
+		t.Errorf("Expected key with short x to fail unmarshalling")
+	}
+	if !strings.Contains(err.Error(), "wrong length for d") {
+		t.Errorf("Wrong error for short d, got %q", err)
+	}
+	if jwk.Valid() {
+		t.Errorf("Expected key to be invalid, but it was valid.")
+	}
+}
+
+func TestJWKPaddingX(t *testing.T) {
+	key := `{
+    "kty": "EC",
+    "crv": "P-256",
+    "x": "nPTIABcDASY6FNGSNfHCB51tY7qChtgzeVazOtLrwQ",
+    "y": "vEEs4V0egJkNyM2Q4pp001zu14VcpQ0_Ei8xOOPxKZs"
+  }`
+	var jwk JSONWebKey
+	err := jwk.UnmarshalJSON([]byte(key))
+	if err == nil {
+		t.Errorf("Expected key with short x to fail unmarshalling")
+	}
+	if !strings.Contains(err.Error(), "wrong length for x") {
+		t.Errorf("Wrong error for short x, got %q", err)
+	}
+	if jwk.Valid() {
+		t.Errorf("Expected key to be invalid, but it was valid.")
+	}
+}
+
+func TestJWKPaddingY(t *testing.T) {
+	key := `{
+    "kty": "EC",
+    "crv": "P-256",
+    "x": "vEEs4V0egJkNyM2Q4pp001zu14VcpQ0_Ei8xOOPxKZs",
+    "y": "nPTIABcDASY6FNGSNfHCB51tY7qChtgzeVazOtLrwQ"
+  }`
+	var jwk JSONWebKey
+	err := jwk.UnmarshalJSON([]byte(key))
+	if err == nil {
+		t.Errorf("Expected key with short y to fail unmarshalling")
+	}
+	if !strings.Contains(err.Error(), "wrong length for y") {
+		t.Errorf("Wrong error for short y, got %q", err)
+	}
+	if jwk.Valid() {
+		t.Errorf("Expected key to be invalid, but it was valid.")
+	}
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/jws.go b/vendor/gopkg.in/square/go-jose.v2/jws.go
new file mode 100644
index 0000000..8b59b6a
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/jws.go
@@ -0,0 +1,321 @@
+/*-
+ * Copyright 2014 Square Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package jose
+
+import (
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"strings"
+
+	"gopkg.in/square/go-jose.v2/json"
+)
+
+// rawJSONWebSignature represents a raw JWS JSON object. Used for parsing/serializing.
+type rawJSONWebSignature struct {
+	Payload    *byteBuffer        `json:"payload,omitempty"`
+	Signatures []rawSignatureInfo `json:"signatures,omitempty"`
+	Protected  *byteBuffer        `json:"protected,omitempty"`
+	Header     *rawHeader         `json:"header,omitempty"`
+	Signature  *byteBuffer        `json:"signature,omitempty"`
+}
+
+// rawSignatureInfo represents a single JWS signature over the JWS payload and protected header.
+type rawSignatureInfo struct {
+	Protected *byteBuffer `json:"protected,omitempty"`
+	Header    *rawHeader  `json:"header,omitempty"`
+	Signature *byteBuffer `json:"signature,omitempty"`
+}
+
+// JSONWebSignature represents a signed JWS object after parsing.
+type JSONWebSignature struct {
+	payload []byte
+	// Signatures attached to this object (may be more than one for multi-sig).
+	// Be careful about accessing these directly, prefer to use Verify() or
+	// VerifyMulti() to ensure that the data you're getting is verified.
+	Signatures []Signature
+}
+
+// Signature represents a single signature over the JWS payload and protected header.
+type Signature struct {
+	// Merged header fields. Contains both protected and unprotected header
+	// values. Prefer using Protected and Unprotected fields instead of this.
+	// Values in this header may or may not have been signed and in general
+	// should not be trusted.
+	Header Header
+
+	// Protected header. Values in this header were signed and
+	// will be verified as part of the signature verification process.
+	Protected Header
+
+	// Unprotected header. Values in this header were not signed
+	// and in general should not be trusted.
+	Unprotected Header
+
+	// The actual signature value
+	Signature []byte
+
+	protected *rawHeader
+	header    *rawHeader
+	original  *rawSignatureInfo
+}
+
+// ParseSigned parses a signed message in compact or full serialization format.
+func ParseSigned(input string) (*JSONWebSignature, error) {
+	input = stripWhitespace(input)
+	if strings.HasPrefix(input, "{") {
+		return parseSignedFull(input)
+	}
+
+	return parseSignedCompact(input)
+}
+
+// Get a header value
+func (sig Signature) mergedHeaders() rawHeader {
+	out := rawHeader{}
+	out.merge(sig.protected)
+	out.merge(sig.header)
+	return out
+}
+
+// Compute data to be signed
+func (obj JSONWebSignature) computeAuthData(payload []byte, signature *Signature) []byte {
+	var serializedProtected string
+
+	if signature.original != nil && signature.original.Protected != nil {
+		serializedProtected = signature.original.Protected.base64()
+	} else if signature.protected != nil {
+		serializedProtected = base64.RawURLEncoding.EncodeToString(mustSerializeJSON(signature.protected))
+	} else {
+		serializedProtected = ""
+	}
+
+	return []byte(fmt.Sprintf("%s.%s",
+		serializedProtected,
+		base64.RawURLEncoding.EncodeToString(payload)))
+}
+
+// parseSignedFull parses a message in full format.
+func parseSignedFull(input string) (*JSONWebSignature, error) {
+	var parsed rawJSONWebSignature
+	err := json.Unmarshal([]byte(input), &parsed)
+	if err != nil {
+		return nil, err
+	}
+
+	return parsed.sanitized()
+}
+
+// sanitized produces a cleaned-up JWS object from the raw JSON.
+func (parsed *rawJSONWebSignature) sanitized() (*JSONWebSignature, error) {
+	if parsed.Payload == nil {
+		return nil, fmt.Errorf("square/go-jose: missing payload in JWS message")
+	}
+
+	obj := &JSONWebSignature{
+		payload:    parsed.Payload.bytes(),
+		Signatures: make([]Signature, len(parsed.Signatures)),
+	}
+
+	if len(parsed.Signatures) == 0 {
+		// No signatures array, must be flattened serialization
+		signature := Signature{}
+		if parsed.Protected != nil && len(parsed.Protected.bytes()) > 0 {
+			signature.protected = &rawHeader{}
+			err := json.Unmarshal(parsed.Protected.bytes(), signature.protected)
+			if err != nil {
+				return nil, err
+			}
+		}
+
+		// Check that there is not a nonce in the unprotected header
+		if parsed.Header != nil && parsed.Header.getNonce() != "" {
+			return nil, ErrUnprotectedNonce
+		}
+
+		signature.header = parsed.Header
+		signature.Signature = parsed.Signature.bytes()
+		// Make a fake "original" rawSignatureInfo to store the unprocessed
+		// Protected header. This is necessary because the Protected header can
+		// contain arbitrary fields not registered as part of the spec. See
+		// https://tools.ietf.org/html/draft-ietf-jose-json-web-signature-41#section-4
+		// If we unmarshal Protected into a rawHeader with its explicit list of fields,
+		// we cannot marshal losslessly. So we have to keep around the original bytes.
+		// This is used in computeAuthData, which will first attempt to use
+		// the original bytes of a protected header, and fall back on marshaling the
+		// header struct only if those bytes are not available.
+		signature.original = &rawSignatureInfo{
+			Protected: parsed.Protected,
+			Header:    parsed.Header,
+			Signature: parsed.Signature,
+		}
+
+		var err error
+		signature.Header, err = signature.mergedHeaders().sanitized()
+		if err != nil {
+			return nil, err
+		}
+
+		if signature.header != nil {
+			signature.Unprotected, err = signature.header.sanitized()
+			if err != nil {
+				return nil, err
+			}
+		}
+
+		if signature.protected != nil {
+			signature.Protected, err = signature.protected.sanitized()
+			if err != nil {
+				return nil, err
+			}
+		}
+
+		// As per RFC 7515 Section 4.1.3, only public keys are allowed to be embedded.
+		jwk := signature.Header.JSONWebKey
+		if jwk != nil && (!jwk.Valid() || !jwk.IsPublic()) {
+			return nil, errors.New("square/go-jose: invalid embedded jwk, must be public key")
+		}
+
+		obj.Signatures = append(obj.Signatures, signature)
+	}
+
+	for i, sig := range parsed.Signatures {
+		if sig.Protected != nil && len(sig.Protected.bytes()) > 0 {
+			obj.Signatures[i].protected = &rawHeader{}
+			err := json.Unmarshal(sig.Protected.bytes(), obj.Signatures[i].protected)
+			if err != nil {
+				return nil, err
+			}
+		}
+
+		// Check that there is not a nonce in the unprotected header
+		if sig.Header != nil && sig.Header.getNonce() != "" {
+			return nil, ErrUnprotectedNonce
+		}
+
+		var err error
+		obj.Signatures[i].Header, err = obj.Signatures[i].mergedHeaders().sanitized()
+		if err != nil {
+			return nil, err
+		}
+
+		if obj.Signatures[i].header != nil {
+			obj.Signatures[i].Unprotected, err = obj.Signatures[i].header.sanitized()
+			if err != nil {
+				return nil, err
+			}
+		}
+
+		if obj.Signatures[i].protected != nil {
+			obj.Signatures[i].Protected, err = obj.Signatures[i].protected.sanitized()
+			if err != nil {
+				return nil, err
+			}
+		}
+
+		obj.Signatures[i].Signature = sig.Signature.bytes()
+
+		// As per RFC 7515 Section 4.1.3, only public keys are allowed to be embedded.
+		jwk := obj.Signatures[i].Header.JSONWebKey
+		if jwk != nil && (!jwk.Valid() || !jwk.IsPublic()) {
+			return nil, errors.New("square/go-jose: invalid embedded jwk, must be public key")
+		}
+
+		// Copy value of sig
+		original := sig
+
+		obj.Signatures[i].header = sig.Header
+		obj.Signatures[i].original = &original
+	}
+
+	return obj, nil
+}
+
+// parseSignedCompact parses a message in compact format.
+func parseSignedCompact(input string) (*JSONWebSignature, error) {
+	parts := strings.Split(input, ".")
+	if len(parts) != 3 {
+		return nil, fmt.Errorf("square/go-jose: compact JWS format must have three parts")
+	}
+
+	rawProtected, err := base64.RawURLEncoding.DecodeString(parts[0])
+	if err != nil {
+		return nil, err
+	}
+
+	payload, err := base64.RawURLEncoding.DecodeString(parts[1])
+	if err != nil {
+		return nil, err
+	}
+
+	signature, err := base64.RawURLEncoding.DecodeString(parts[2])
+	if err != nil {
+		return nil, err
+	}
+
+	raw := &rawJSONWebSignature{
+		Payload:   newBuffer(payload),
+		Protected: newBuffer(rawProtected),
+		Signature: newBuffer(signature),
+	}
+	return raw.sanitized()
+}
+
+// CompactSerialize serializes an object using the compact serialization format.
+func (obj JSONWebSignature) CompactSerialize() (string, error) {
+	if len(obj.Signatures) != 1 || obj.Signatures[0].header != nil || obj.Signatures[0].protected == nil {
+		return "", ErrNotSupported
+	}
+
+	serializedProtected := mustSerializeJSON(obj.Signatures[0].protected)
+
+	return fmt.Sprintf(
+		"%s.%s.%s",
+		base64.RawURLEncoding.EncodeToString(serializedProtected),
+		base64.RawURLEncoding.EncodeToString(obj.payload),
+		base64.RawURLEncoding.EncodeToString(obj.Signatures[0].Signature)), nil
+}
+
+// FullSerialize serializes an object using the full JSON serialization format.
+func (obj JSONWebSignature) FullSerialize() string {
+	raw := rawJSONWebSignature{
+		Payload: newBuffer(obj.payload),
+	}
+
+	if len(obj.Signatures) == 1 {
+		if obj.Signatures[0].protected != nil {
+			serializedProtected := mustSerializeJSON(obj.Signatures[0].protected)
+			raw.Protected = newBuffer(serializedProtected)
+		}
+		raw.Header = obj.Signatures[0].header
+		raw.Signature = newBuffer(obj.Signatures[0].Signature)
+	} else {
+		raw.Signatures = make([]rawSignatureInfo, len(obj.Signatures))
+		for i, signature := range obj.Signatures {
+			raw.Signatures[i] = rawSignatureInfo{
+				Header:    signature.header,
+				Signature: newBuffer(signature.Signature),
+			}
+
+			if signature.protected != nil {
+				raw.Signatures[i].Protected = newBuffer(mustSerializeJSON(signature.protected))
+			}
+		}
+	}
+
+	return string(mustSerializeJSON(raw))
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/jws_test.go b/vendor/gopkg.in/square/go-jose.v2/jws_test.go
new file mode 100644
index 0000000..1b80419
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/jws_test.go
@@ -0,0 +1,616 @@
+/*-
+ * Copyright 2014 Square Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package jose
+
+import (
+	"crypto/x509"
+	"strings"
+	"testing"
+)
+
+const trustedCA = `
+-----BEGIN CERTIFICATE-----
+MIIE6DCCAtCgAwIBAgIBATANBgkqhkiG9w0BAQsFADAUMRIwEAYDVQQDEwlUcnVz
+dGVkQ0EwHhcNMTgwMzI4MTg0MzA0WhcNMzgwMzI4MTg0MzA0WjAUMRIwEAYDVQQD
+EwlUcnVzdGVkQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCsHcd3
+uaKBilWQUe2epNf86xvq2HZV+JDULjJlKfUQAkpG+huHDEMiPEFPSlQK17bFj7gc
+qOx/INeeCU2nBVtZDtlm3U0jfQWO2F2kZgH1JWnEArrAWWy3BP/NYv7apBLcl7nD
+hkL4USVUnXF8mtuegiSMI2YT7TVchGzYMjrj/j+oRuDm1GF1OxoIMeUuVmqyJ6jK
+Kxv9YVmCB+e/QaUltkPGwxl2dKWdBwECXDgSr7hcZhT8ANmgFR1dJjLCy0Us12yw
+5eKUANDlfNP+z9urykoAwHXpBlmga1ze45aL+p+7K+8sl/PgMqKO7VdT5GBsOCzf
+xaBDG5Qy92Di34Sc27ZZz0mfaIy5kySnceBclMyWb8vdhEGkyHVsGpWc63JBmtg+
+bKeh876m7KVLfiykfpMqHUhq/ImQwiQTwX2RonFK5gP+XU0I9V+4rE0iqucbcvCS
+HuHzhf6B+TybhalRsvOZ6GB/SokF5YCmf8ylAq4be/HSxnJQcBhpSSQp0zz4ZKOD
+ikXuwf29yhWZ0lgIyaZpT9H4QecWNcyx4UcqO3wQAGjxadTG3gzjLu/OJwPkw+bK
+RvXWSBZjlQ9+JPmrHH+oKMgHshR4TQmtmXqXLaarrAe+HXCZEiBKFOqPgeo2RMxr
+LAO+MYIsVtEz39gISRhEvqcAls01sV1l7oGicQIDAQABo0UwQzAOBgNVHQ8BAf8E
+BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQUy9Nqk0mDRwC5tcmN
+xQ1YWO5MAhgwDQYJKoZIhvcNAQELBQADggIBAHbpsqY+tPSj8BSky+acZoZjF7fZ
+Ae3MKVogwm5tecmwTKf5xDj9J99ZpGvcWCKtoxxWw0LZ+JI/aeqANSRDXZIelcIw
+yZefw06z/coQJwAIy1RSoKJPV72mkG0Es9w2HxSEoLaZ9tql0TyV8D/QseUM8Yt/
+nNtShRoj6iMnZjhmut5pLfrLWHwQkt4fguBpL7rtydS/wAsOmnJ7lmOrU6zrBJzD
+vEER3AJtgdIt4GvKf4MupKLgKvYDB4sUQVmMyAS78B9+WZDDRTClsx+/Oc1ggkWz
+8X7EmIw+3U9V2hd67qZ81EwcSB8ixV06E7ZcbhnJs7ds7swqUjwMArFWuzqO4cjW
+2BnyVzCO9pymFLI7qol32xCEgaQlOVS/kFHP3meygfeaeYe902sJw6NevOA4e0AO
+AKR8FDfGRXJ9cOmYzeHeWKex8yt1Ul6+N8SXzjOhf39JM0QqTfHN7pPfFthTAFOs
+9rI/buJteJqR1WxgVk/jY4wLGEOcEyO6Y/Uj5iWWTvm5G/C1yZfSg+NvWoytxZ7P
+3S0qtEfmT4UwuHBsd5ZfEZoxb+GbqL/nhrKz/0B9LyKS0SJP9+mz7nSORz7t35Uc
+BhiG6T9W7P/NRW4Tqb2tEN1VwU6eP5SEf7c7C1VVaepk0fvc1p5dl67IERqPucPD
+dT2rDsCMBV7SXMUM
+-----END CERTIFICATE-----`
+
+const intermediateCA = `
+-----BEGIN CERTIFICATE-----
+MIIEHTCCAgWgAwIBAgIQXzZsEQv0cvSRLJAkS9FmWTANBgkqhkiG9w0BAQsFADAU
+MRIwEAYDVQQDEwlUcnVzdGVkQ0EwHhcNMTgwMzI4MTg0MzMzWhcNMzgwMzI4MTg0
+MzAzWjAZMRcwFQYDVQQDEw5JbnRlcm1lZGlhdGVDQTCCASIwDQYJKoZIhvcNAQEB
+BQADggEPADCCAQoCggEBAN3aYpH/1yEYf/kHuHWyO3AO4tgwlYYLhCDT2GvaPdaE
+cqhe/VuYiqx3xY7IRDqsW2rau/OXgW6KzLHdRZHogK07hUj1Lfr7X+Oqbp22IV4y
+dyiL7jwK9AtVXvDuuv5ET+oRfV82j0uhyk0ueGD9r6C/h+6NTzHBD+3xo6Yuc0Vk
+BfY5zIyhaFqlm1aRYvupDRjC/63uBgAlrGxy2LyiTMVnYMuxoJM5ahDepz3sqjuN
+WVyPhfGwIezjXuXRdEvlmWX05XLnsTdP4zu4fHq9Z7c3TKWWONM3z64ECAZmGQVf
+MAcEDX7qP0gZX5PCT+0WcvTgTWE4Q+WIh5AmYyxQ04cCAwEAAaNmMGQwDgYDVR0P
+AQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYEFMAYlq86RZzT
+WxLpYE7KTTM7DHOuMB8GA1UdIwQYMBaAFMvTapNJg0cAubXJjcUNWFjuTAIYMA0G
+CSqGSIb3DQEBCwUAA4ICAQBmYRpQoWEm5g16kwUrpwWrH7OIqqMtUhM1dcskECfk
+i3/hcsV+MQRkGHLIItucYIWqs7oOQIglsyGcohAbnvE1PVtKKojUHC0lfbjgIenD
+Pbvz15QB6A3KLDR82QbQGeGniACy924p66zlfPwHJbkMo5ZaqtNqI//EIa2YCpyy
+okhFXaSFmPWXXrTOCsEEsFJKsoSCH1KUpTcwACGkkilNseg1edZB6/lBDwybxVuY
++dbUlHip3r5tFcP66Co3tKAaEcVY0AsZ/8GKwH+IM2AR6q7jdn9Gp2OX4E1ul9Wy
++hW5GHMmfixkgTVwRowuKgkCPEKV2/Xy3k9rlSpnKr2NpYYq0mu6An9HYt8THQ+e
+wGZHwWufuDFDWuzlu7CxFOjpXLKv8qqVnwSFC91S3HsPAzPKLC9ZMEC+iQs2Vkes
+Os0nFLZeMaMGAO5W6xiyQ5p94oo0bqa1XbmSV1bNp1HWuNEGIiZKrEUDxfYuDc6f
+C6hJZKsjJkMkBeadlQAlLcjIx1rDV171CKLLTxy/dT5kv4p9UrJlnleyMVG6S/3d
+6nX/WLSgZIMYbOwiZVVPlSrobuG38ULJMCSuxndxD0l+HahJaH8vYXuR67A0XT+b
+TEe305AI6A/9MEaRrActBnq6/OviQgBsKAvtTv1FmDbnpZsKeoFuwc3OPdTveQdC
+RA==
+-----END CERTIFICATE-----`
+
+func TestEmbeddedHMAC(t *testing.T) {
+	// protected: {"alg":"HS256", "jwk":{"kty":"oct", "k":"MTEx"}}, aka HMAC key.
+	msg := `{"payload":"TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQ","protected":"eyJhbGciOiJIUzI1NiIsICJqd2siOnsia3R5Ijoib2N0IiwgImsiOiJNVEV4In19","signature":"lvo41ZZsuHwQvSh0uJtEXRR3vmuBJ7in6qMoD7p9jyo"}`
+
+	_, err := ParseSigned(msg)
+	if err == nil {
+		t.Error("should not allow parsing JWS with embedded JWK with HMAC key")
+	}
+}
+
+func TestCompactParseJWS(t *testing.T) {
+	// Should parse
+	msg := "eyJhbGciOiJYWVoifQ.cGF5bG9hZA.c2lnbmF0dXJl"
+	_, err := ParseSigned(msg)
+	if err != nil {
+		t.Error("Unable to parse valid message:", err)
+	}
+
+	// Should parse (detached signature missing payload)
+	msg = "eyJhbGciOiJYWVoifQ..c2lnbmF0dXJl"
+	_, err = ParseSigned(msg)
+	if err != nil {
+		t.Error("Unable to parse valid message:", err)
+	}
+
+	// Messages that should fail to parse
+	failures := []string{
+		// Not enough parts
+		"eyJhbGciOiJYWVoifQ.cGF5bG9hZA",
+		// Invalid signature
+		"eyJhbGciOiJYWVoifQ.cGF5bG9hZA.////",
+		// Invalid payload
+		"eyJhbGciOiJYWVoifQ.////.c2lnbmF0dXJl",
+		// Invalid header
+		"////.eyJhbGciOiJYWVoifQ.c2lnbmF0dXJl",
+		// Invalid header
+		"cGF5bG9hZA.cGF5bG9hZA.c2lnbmF0dXJl",
+	}
+
+	for i := range failures {
+		_, err = ParseSigned(failures[i])
+		if err == nil {
+			t.Error("Able to parse invalid message")
+		}
+	}
+}
+
+func TestFullParseJWS(t *testing.T) {
+	// Messages that should succeed to parse
+	successes := []string{
+		"{\"payload\":\"CUJD\",\"signatures\":[{\"protected\":\"e30\",\"header\":{\"kid\":\"XYZ\"},\"signature\":\"CUJD\"},{\"protected\":\"e30\",\"signature\":\"CUJD\"}]}",
+	}
+
+	for i := range successes {
+		_, err := ParseSigned(successes[i])
+		if err != nil {
+			t.Error("Unble to parse valid message", err, successes[i])
+		}
+	}
+
+	// Messages that should fail to parse
+	failures := []string{
+		// Empty
+		"{}",
+		// Invalid JSON
+		"{XX",
+		// Invalid protected header
+		"{\"payload\":\"CUJD\",\"signatures\":[{\"protected\":\"CUJD\",\"header\":{\"kid\":\"XYZ\"},\"signature\":\"CUJD\"}]}",
+		// Invalid protected header
+		"{\"payload\":\"CUJD\",\"protected\":\"CUJD\",\"header\":{\"kid\":\"XYZ\"},\"signature\":\"CUJD\"}",
+		// Invalid protected header
+		"{\"payload\":\"CUJD\",\"signatures\":[{\"protected\":\"###\",\"header\":{\"kid\":\"XYZ\"},\"signature\":\"CUJD\"}]}",
+		// Invalid payload
+		"{\"payload\":\"###\",\"signatures\":[{\"protected\":\"CUJD\",\"header\":{\"kid\":\"XYZ\"},\"signature\":\"CUJD\"}]}",
+		// Invalid payload
+		"{\"payload\":\"CUJD\",\"signatures\":[{\"protected\":\"e30\",\"header\":{\"kid\":\"XYZ\"},\"signature\":\"###\"}]}",
+	}
+
+	for i := range failures {
+		_, err := ParseSigned(failures[i])
+		if err == nil {
+			t.Error("Able to parse invalid message", err, failures[i])
+		}
+	}
+}
+
+func TestRejectUnprotectedJWSNonce(t *testing.T) {
+	// No need to test compact, since that's always protected
+
+	// Flattened JSON
+	input := `{
+		"header": { "nonce": "should-cause-an-error" },
+		"payload": "does-not-matter",
+		"signature": "does-not-matter"
+	}`
+	_, err := ParseSigned(input)
+	if err == nil {
+		t.Error("JWS with an unprotected nonce parsed as valid.")
+	} else if err != ErrUnprotectedNonce {
+		t.Errorf("Improper error for unprotected nonce: %v", err)
+	}
+
+	// Full JSON
+	input = `{
+		"payload": "does-not-matter",
+ 		"signatures": [{
+ 			"header": { "nonce": "should-cause-an-error" },
+			"signature": "does-not-matter"
+		}]
+	}`
+	_, err = ParseSigned(input)
+	if err == nil {
+		t.Error("JWS with an unprotected nonce parsed as valid.")
+	} else if err != ErrUnprotectedNonce {
+		t.Errorf("Improper error for unprotected nonce: %v", err)
+	}
+}
+
+func TestVerifyFlattenedWithIncludedUnprotectedKey(t *testing.T) {
+	input := `{
+			"header": {
+					"alg": "RS256",
+					"jwk": {
+							"e": "AQAB",
+							"kty": "RSA",
+							"n": "tSwgy3ORGvc7YJI9B2qqkelZRUC6F1S5NwXFvM4w5-M0TsxbFsH5UH6adigV0jzsDJ5imAechcSoOhAh9POceCbPN1sTNwLpNbOLiQQ7RD5mY_pSUHWXNmS9R4NZ3t2fQAzPeW7jOfF0LKuJRGkekx6tXP1uSnNibgpJULNc4208dgBaCHo3mvaE2HV2GmVl1yxwWX5QZZkGQGjNDZYnjFfa2DKVvFs0QbAk21ROm594kAxlRlMMrvqlf24Eq4ERO0ptzpZgm_3j_e4hGRD39gJS7kAzK-j2cacFQ5Qi2Y6wZI2p-FCq_wiYsfEAIkATPBiLKl_6d_Jfcvs_impcXQ"
+					}
+			},
+			"payload": "Zm9vCg",
+			"signature": "hRt2eYqBd_MyMRNIh8PEIACoFtmBi7BHTLBaAhpSU6zyDAFdEBaX7us4VB9Vo1afOL03Q8iuoRA0AT4akdV_mQTAQ_jhTcVOAeXPr0tB8b8Q11UPQ0tXJYmU4spAW2SapJIvO50ntUaqU05kZd0qw8-noH1Lja-aNnU-tQII4iYVvlTiRJ5g8_CADsvJqOk6FcHuo2mG643TRnhkAxUtazvHyIHeXMxydMMSrpwUwzMtln4ZJYBNx4QGEq6OhpAD_VSp-w8Lq5HOwGQoNs0bPxH1SGrArt67LFQBfjlVr94E1sn26p4vigXm83nJdNhWAMHHE9iV67xN-r29LT-FjA"
+	}`
+
+	jws, err := ParseSigned(input)
+	if err != nil {
+		t.Error("Unable to parse valid message.")
+	}
+	if len(jws.Signatures) != 1 {
+		t.Error("Too many or too few signatures.")
+	}
+	sig := jws.Signatures[0]
+	if sig.Header.JSONWebKey == nil {
+		t.Error("No JWK in signature header.")
+	}
+	payload, err := jws.Verify(sig.Header.JSONWebKey)
+	if err != nil {
+		t.Errorf("Signature did not validate: %v", err)
+	}
+	if string(payload) != "foo\n" {
+		t.Errorf("Payload was incorrect: '%s' should have been 'foo\\n'", string(payload))
+	}
+}
+
+// Test verification of a detached signature
+func TestDetachedVerifyJWS(t *testing.T) {
+	rsaPublicKey, err := x509.ParsePKIXPublicKey(fromBase64Bytes(`
+		MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3aLSGwbeX0ZA2Ha+EvELaIFGzO
+		91+Q15JQc/tdGdCgGW3XAbrh7ZUhDh1XKzbs+UOQxqn3Eq4YOx18IG0WsJSuCaHQIxnDlZ
+		t/GP8WLwjMC0izlJLm2SyfM/EEoNpmTC3w6MQ2dHK7SZ9Zoq+sKijQd+V7CYdr8zHMpDrd
+		NKoEcR0HjmvzzdMoUChhkGH5TaNbZyollULTggepaYUKS8QphqdSDMWiSetKG+g6V87lv6
+		CVYyK1FF6g7Esp5OOj5pNn3/bmF+7V+b7TvK91NCIlURCjE9toRgNoIP4TDnWRn/vvfZ3G
+		zNrtWmlizqz3r5KdvIs71ahWgMUSD4wfazrwIDAQAB`))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	sampleMessages := []string{
+		"eyJhbGciOiJSUzI1NiJ9.TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQ.YHX849fvekz6wJGeyqnQhFqyHFcUXNJKj3o2w3ddR46YLlsCopUJrlifRU_ZuTWzpYxt5oC--T2eoqMhlCvltSWrE5_1_EumqiMfAYsZULx9E6Jns7q3w7mttonYFSIh7aR3-yg2HMMfTCgoAY1y_AZ4VjXwHDcZ5gu1oZDYgvZF4uXtCmwT6e5YtR1m8abiWPF8BgoTG_BD3KV6ClLj_QQiNFdfdxAMDw7vKVOKG1T7BFtz6cDs2Q3ILS4To5E2IjcVSSYS8mi77EitCrWmrqbK_G3WCdKeUFGnMnyuKXaCDy_7FLpAZ6Z5RomRr5iskXeJZdZqIKcJV8zl4fpsPA",
+		"eyJhbGciOiJSUzM4NCJ9.TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQ.meyfoOTjAAjXHFYiNlU7EEnsYtbeUYeEglK6BL_cxISEr2YAGLr1Gwnn2HnucTnH6YilyRio7ZC1ohy_ZojzmaljPHqpr8kn1iqNFu9nFE2M16ZPgJi38-PGzppcDNliyzOQO-c7L-eA-v8Gfww5uyRaOJdiWg-hUJmeGBIngPIeLtSVmhJtz8oTeqeNdUOqQv7f7VRCuvagLhW1PcEM91VUS-gS0WEUXoXWZ2lp91No0v1O24izgX3__FKiX_16XhrOfAgJ82F61vjbTIQYwhexHPZyYTlXYt_scNRzFGhSKeGFin4zVdFLOXWJqKWdUd5IrDP5Nya3FSoWbWDXAg",
+	}
+
+	for _, msg := range sampleMessages {
+		obj, err := ParseSigned(msg)
+		if err != nil {
+			t.Error("unable to parse message", msg, err)
+			continue
+		}
+		payload := obj.payload
+		obj.payload = nil
+		err = obj.DetachedVerify(payload, rsaPublicKey)
+		if err != nil {
+			t.Error("unable to verify message", msg, err)
+			continue
+		}
+		idx, _, err := obj.DetachedVerifyMulti(payload, rsaPublicKey)
+		if idx != 0 || err != nil {
+			t.Error("unable to verify message", msg, err)
+			continue
+		}
+	}
+}
+
+func TestVerifyFlattenedWithPrivateProtected(t *testing.T) {
+	// The protected field contains a Private Header Parameter name, per
+	// https://tools.ietf.org/html/draft-ietf-jose-json-web-signature-41#section-4
+	// Base64-decoded, it's '{"nonce":"8HIepUNFZUa-exKTrXVf4g"}'
+	input := `{"header":{"alg":"RS256","jwk":{"kty":"RSA","n":"7ixeydcbxxppzxrBphrW1atUiEZqTpiHDpI-79olav5XxAgWolHmVsJyxzoZXRxmtED8PF9-EICZWBGdSAL9ZTD0hLUCIsPcpdgT_LqNW3Sh2b2caPL2hbMF7vsXvnCGg9varpnHWuYTyRrCLUF9vM7ES-V3VCYTa7LcCSRm56Gg9r19qar43Z9kIKBBxpgt723v2cC4bmLmoAX2s217ou3uCpCXGLOeV_BesG4--Nl3pso1VhCfO85wEWjmW6lbv7Kg4d7Jdkv5DjDZfJ086fkEAYZVYGRpIgAvJBH3d3yKDCrSByUEud1bWuFjQBmMaeYOrVDXO_mbYg5PwUDMhw","e":"AQAB"}},"protected":"eyJub25jZSI6IjhISWVwVU5GWlVhLWV4S1RyWFZmNGcifQ","payload":"eyJjb250YWN0IjpbIm1haWx0bzpmb29AYmFyLmNvbSJdfQ","signature":"AyvVGMgXsQ1zTdXrZxE_gyO63pQgotL1KbI7gv6Wi8I7NRy0iAOkDAkWcTQT9pcCYApJ04lXfEDZfP5i0XgcFUm_6spxi5mFBZU-NemKcvK9dUiAbXvb4hB3GnaZtZiuVnMQUb_ku4DOaFFKbteA6gOYCnED_x7v0kAPHIYrQnvIa-KZ6pTajbV9348zgh9TL7NgGIIsTcMHd-Jatr4z1LQ0ubGa8tS300hoDhVzfoDQaEetYjCo1drR1RmdEN1SIzXdHOHfubjA3ZZRbrF_AJnNKpRRoIwzu1VayOhRmdy1qVSQZq_tENF4VrQFycEL7DhG7JLoXC4T2p1urwMlsw"}`
+
+	jws, err := ParseSigned(input)
+	if err != nil {
+		t.Error("Unable to parse valid message.")
+	}
+	if len(jws.Signatures) != 1 {
+		t.Error("Too many or too few signatures.")
+	}
+	sig := jws.Signatures[0]
+	if sig.Header.JSONWebKey == nil {
+		t.Error("No JWK in signature header.")
+	}
+	payload, err := jws.Verify(sig.Header.JSONWebKey)
+	if err != nil {
+		t.Errorf("Signature did not validate: %v", err)
+	}
+	expected := "{\"contact\":[\"mailto:foo@bar.com\"]}"
+	if string(payload) != expected {
+		t.Errorf("Payload was incorrect: '%s' should have been '%s'", string(payload), expected)
+	}
+}
+
+// Test vectors generated with nimbus-jose-jwt
+func TestSampleNimbusJWSMessagesRSA(t *testing.T) {
+	rsaPublicKey, err := x509.ParsePKIXPublicKey(fromBase64Bytes(`
+		MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3aLSGwbeX0ZA2Ha+EvELaIFGzO
+		91+Q15JQc/tdGdCgGW3XAbrh7ZUhDh1XKzbs+UOQxqn3Eq4YOx18IG0WsJSuCaHQIxnDlZ
+		t/GP8WLwjMC0izlJLm2SyfM/EEoNpmTC3w6MQ2dHK7SZ9Zoq+sKijQd+V7CYdr8zHMpDrd
+		NKoEcR0HjmvzzdMoUChhkGH5TaNbZyollULTggepaYUKS8QphqdSDMWiSetKG+g6V87lv6
+		CVYyK1FF6g7Esp5OOj5pNn3/bmF+7V+b7TvK91NCIlURCjE9toRgNoIP4TDnWRn/vvfZ3G
+		zNrtWmlizqz3r5KdvIs71ahWgMUSD4wfazrwIDAQAB`))
+	if err != nil {
+		panic(err)
+	}
+
+	rsaSampleMessages := []string{
+		"eyJhbGciOiJSUzI1NiJ9.TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQ.YHX849fvekz6wJGeyqnQhFqyHFcUXNJKj3o2w3ddR46YLlsCopUJrlifRU_ZuTWzpYxt5oC--T2eoqMhlCvltSWrE5_1_EumqiMfAYsZULx9E6Jns7q3w7mttonYFSIh7aR3-yg2HMMfTCgoAY1y_AZ4VjXwHDcZ5gu1oZDYgvZF4uXtCmwT6e5YtR1m8abiWPF8BgoTG_BD3KV6ClLj_QQiNFdfdxAMDw7vKVOKG1T7BFtz6cDs2Q3ILS4To5E2IjcVSSYS8mi77EitCrWmrqbK_G3WCdKeUFGnMnyuKXaCDy_7FLpAZ6Z5RomRr5iskXeJZdZqIKcJV8zl4fpsPA",
+		"eyJhbGciOiJSUzM4NCJ9.TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQ.meyfoOTjAAjXHFYiNlU7EEnsYtbeUYeEglK6BL_cxISEr2YAGLr1Gwnn2HnucTnH6YilyRio7ZC1ohy_ZojzmaljPHqpr8kn1iqNFu9nFE2M16ZPgJi38-PGzppcDNliyzOQO-c7L-eA-v8Gfww5uyRaOJdiWg-hUJmeGBIngPIeLtSVmhJtz8oTeqeNdUOqQv7f7VRCuvagLhW1PcEM91VUS-gS0WEUXoXWZ2lp91No0v1O24izgX3__FKiX_16XhrOfAgJ82F61vjbTIQYwhexHPZyYTlXYt_scNRzFGhSKeGFin4zVdFLOXWJqKWdUd5IrDP5Nya3FSoWbWDXAg",
+		"eyJhbGciOiJSUzUxMiJ9.TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQ.rQPz0PDh8KyE2AX6JorgI0MLwv-qi1tcWlz6tuZuWQG1hdrlzq5tR1tQg1evYNc_SDDX87DWTSKXT7JEqhKoFixLfZa13IJrOc7FB8r5ZLx7OwOBC4F--OWrvxMA9Y3MTJjPN3FemQePUo-na2vNUZv-YgkcbuOgbO3hTxwQ7j1JGuqy-YutXOFnccdXvntp3t8zYZ4Mg1It_IyL9pzgGqHIEmMV1pCFGHsDa-wStB4ffmdhrADdYZc0q_SvxUdobyC_XzZCz9ENzGIhgwYxyyrqg7kjqUGoKmCLmoSlUFW7goTk9IC5SXdUyLPuESxOWNfHoRClGav230GYjPFQFA",
+		"eyJhbGciOiJQUzI1NiJ9.TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQ.UTtxjsv_6x4CdlAmZfAW6Lun3byMjJbcwRp_OlPH2W4MZaZar7aql052mIB_ddK45O9VUz2aphYVRvKPZY8WHmvlTUU30bk0z_cDJRYB9eIJVMOiRCYj0oNkz1iEZqsP0YgngxwuUDv4Q4A6aJ0Bo5E_rZo3AnrVHMHUjPp_ZRRSBFs30tQma1qQ0ApK4Gxk0XYCYAcxIv99e78vldVRaGzjEZmQeAVZx4tGcqZP20vG1L84nlhSGnOuZ0FhR8UjRFLXuob6M7EqtMRoqPgRYw47EI3fYBdeSivAg98E5S8R7R1NJc7ef-l03RvfUSY0S3_zBq_4PlHK6A-2kHb__w",
+		"eyJhbGciOiJSUzM4NCJ9.TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQ.meyfoOTjAAjXHFYiNlU7EEnsYtbeUYeEglK6BL_cxISEr2YAGLr1Gwnn2HnucTnH6YilyRio7ZC1ohy_ZojzmaljPHqpr8kn1iqNFu9nFE2M16ZPgJi38-PGzppcDNliyzOQO-c7L-eA-v8Gfww5uyRaOJdiWg-hUJmeGBIngPIeLtSVmhJtz8oTeqeNdUOqQv7f7VRCuvagLhW1PcEM91VUS-gS0WEUXoXWZ2lp91No0v1O24izgX3__FKiX_16XhrOfAgJ82F61vjbTIQYwhexHPZyYTlXYt_scNRzFGhSKeGFin4zVdFLOXWJqKWdUd5IrDP5Nya3FSoWbWDXAg",
+		"eyJhbGciOiJSUzUxMiJ9.TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQ.rQPz0PDh8KyE2AX6JorgI0MLwv-qi1tcWlz6tuZuWQG1hdrlzq5tR1tQg1evYNc_SDDX87DWTSKXT7JEqhKoFixLfZa13IJrOc7FB8r5ZLx7OwOBC4F--OWrvxMA9Y3MTJjPN3FemQePUo-na2vNUZv-YgkcbuOgbO3hTxwQ7j1JGuqy-YutXOFnccdXvntp3t8zYZ4Mg1It_IyL9pzgGqHIEmMV1pCFGHsDa-wStB4ffmdhrADdYZc0q_SvxUdobyC_XzZCz9ENzGIhgwYxyyrqg7kjqUGoKmCLmoSlUFW7goTk9IC5SXdUyLPuESxOWNfHoRClGav230GYjPFQFA",
+	}
+
+	for _, msg := range rsaSampleMessages {
+		obj, err := ParseSigned(msg)
+		if err != nil {
+			t.Error("unable to parse message", msg, err)
+			continue
+		}
+		payload, err := obj.Verify(rsaPublicKey)
+		if err != nil {
+			t.Error("unable to verify message", msg, err)
+			continue
+		}
+		if string(payload) != "Lorem ipsum dolor sit amet" {
+			t.Error("payload is not what we expected for msg", msg)
+		}
+	}
+}
+
+// Test vectors generated with nimbus-jose-jwt
+func TestSampleNimbusJWSMessagesEC(t *testing.T) {
+	ecPublicKeyP256, err := x509.ParsePKIXPublicKey(fromBase64Bytes("MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIg62jq6FyL1otEj9Up7S35BUrwGF9TVrAzrrY1rHUKZqYIGEg67u/imjgadVcr7y9Q32I0gB8W8FHqbqt696rA=="))
+	if err != nil {
+		panic(err)
+	}
+	ecPublicKeyP384, err := x509.ParsePKIXPublicKey(fromBase64Bytes("MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEPXsVlqCtN2oTY+F+hFZm3M0ldYpb7IeeJM5wYmT0k1RaqzBFDhDMNnYK5Q5x+OyssZrAtHgYDFw02AVJhhng/eHRp7mqmL/vI3wbxJtrLKYldIbBA+9fYBQcKeibjlu5"))
+	if err != nil {
+		panic(err)
+	}
+	ecPublicKeyP521, err := x509.ParsePKIXPublicKey(fromBase64Bytes("MIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQAa2w3MMJ5FWD6tSf68G+Wy5jIhWXOD3IA7pE5IC/myQzo1lWcD8KS57SM6nm4POtPcxyLmDhL7FLuh8DKoIZyvtAAdK8+tOQP7XXRlT2bkvzIuazp05It3TAPu00YzTIpKfDlc19Y1lvf7etrbFqhShD92B+hHmhT4ddrdbPCBDW8hvU="))
+	if err != nil {
+		panic(err)
+	}
+
+	ecPublicKeys := []interface{}{ecPublicKeyP256, ecPublicKeyP384, ecPublicKeyP521}
+
+	ecSampleMessages := []string{
+		"eyJhbGciOiJFUzI1NiJ9.TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQ.MEWJVlvGRQyzMEGOYm4rwuiwxrX-6LjnlbaRDAuhwmnBm2Gtn7pRpGXRTMFZUXsSGDz2L1p-Hz1qn8j9bFIBtQ",
+		"eyJhbGciOiJFUzM4NCJ9.TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQ.nbdjPnJPYQtVNNdBIx8-KbFKplTxrz-hnW5UNhYUY7SBkwHK4NZnqc2Lv4DXoA0aWHq9eiypgOh1kmyPWGEmqKAHUx0xdIEkBoHk3ZsbmhOQuq2jL_wcMUG6nTWNhLrB",
+		"eyJhbGciOiJFUzUxMiJ9.TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQ.AeYNFC1rwIgQv-5fwd8iRyYzvTaSCYTEICepgu9gRId-IW99kbSVY7yH0MvrQnqI-a0L8zwKWDR35fW5dukPAYRkADp3Y1lzqdShFcEFziUVGo46vqbiSajmKFrjBktJcCsfjKSaLHwxErF-T10YYPCQFHWb2nXJOOI3CZfACYqgO84g",
+	}
+
+	for i, msg := range ecSampleMessages {
+		obj, err := ParseSigned(msg)
+		if err != nil {
+			t.Error("unable to parse message", msg, err)
+			continue
+		}
+		payload, err := obj.Verify(ecPublicKeys[i])
+		if err != nil {
+			t.Error("unable to verify message", msg, err)
+			continue
+		}
+		if string(payload) != "Lorem ipsum dolor sit amet" {
+			t.Error("payload is not what we expected for msg", msg)
+		}
+	}
+}
+
+// Test vectors generated with nimbus-jose-jwt
+func TestSampleNimbusJWSMessagesHMAC(t *testing.T) {
+	hmacTestKey := fromHexBytes("DF1FA4F36FFA7FC42C81D4B3C033928D")
+
+	hmacSampleMessages := []string{
+		"eyJhbGciOiJIUzI1NiJ9.TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQ.W5tc_EUhxexcvLYEEOckyyvdb__M5DQIVpg6Nmk1XGM",
+		"eyJhbGciOiJIUzM4NCJ9.TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQ.sBu44lXOJa4Nd10oqOdYH2uz3lxlZ6o32QSGHaoGdPtYTDG5zvSja6N48CXKqdAh",
+		"eyJhbGciOiJIUzUxMiJ9.TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQ.M0yR4tmipsORIix-BitIbxEPGaxPchDfj8UNOpKuhDEfnb7URjGvCKn4nOlyQ1z9mG1FKbwnqR1hOVAWSzAU_w",
+	}
+
+	for _, msg := range hmacSampleMessages {
+		obj, err := ParseSigned(msg)
+		if err != nil {
+			t.Error("unable to parse message", msg, err)
+			continue
+		}
+		payload, err := obj.Verify(hmacTestKey)
+		if err != nil {
+			t.Error("unable to verify message", msg, err)
+			continue
+		}
+		if string(payload) != "Lorem ipsum dolor sit amet" {
+			t.Error("payload is not what we expected for msg", msg)
+		}
+	}
+}
+
+func TestHeaderFieldsCompact(t *testing.T) {
+	msg := "eyJhbGciOiJFUzUxMiJ9.TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQ.AeYNFC1rwIgQv-5fwd8iRyYzvTaSCYTEICepgu9gRId-IW99kbSVY7yH0MvrQnqI-a0L8zwKWDR35fW5dukPAYRkADp3Y1lzqdShFcEFziUVGo46vqbiSajmKFrjBktJcCsfjKSaLHwxErF-T10YYPCQFHWb2nXJOOI3CZfACYqgO84g"
+
+	obj, err := ParseSigned(msg)
+	if err != nil {
+		t.Fatal("unable to parse message", msg, err)
+	}
+	if obj.Signatures[0].Header.Algorithm != "ES512" {
+		t.Error("merged header did not contain expected alg value")
+	}
+	if obj.Signatures[0].Protected.Algorithm != "ES512" {
+		t.Error("protected header did not contain expected alg value")
+	}
+	if obj.Signatures[0].Unprotected.Algorithm != "" {
+		t.Error("unprotected header contained an alg value")
+	}
+}
+
+func TestHeaderFieldsFull(t *testing.T) {
+	msg := `{"payload":"TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQ","protected":"eyJhbGciOiJFUzUxMiJ9","header":{"custom":"test"},"signature":"AeYNFC1rwIgQv-5fwd8iRyYzvTaSCYTEICepgu9gRId-IW99kbSVY7yH0MvrQnqI-a0L8zwKWDR35fW5dukPAYRkADp3Y1lzqdShFcEFziUVGo46vqbiSajmKFrjBktJcCsfjKSaLHwxErF-T10YYPCQFHWb2nXJOOI3CZfACYqgO84g"}`
+
+	obj, err := ParseSigned(msg)
+	if err != nil {
+		t.Fatal("unable to parse message", msg, err)
+	}
+	if obj.Signatures[0].Header.Algorithm != "ES512" {
+		t.Error("merged header did not contain expected alg value")
+	}
+	if obj.Signatures[0].Protected.Algorithm != "ES512" {
+		t.Error("protected header did not contain expected alg value")
+	}
+	if obj.Signatures[0].Unprotected.Algorithm != "" {
+		t.Error("unprotected header contained an alg value")
+	}
+	if obj.Signatures[0].Unprotected.ExtraHeaders["custom"] != "test" {
+		t.Error("unprotected header did not contain custom header value")
+	}
+}
+
+// Test vectors generated with nimbus-jose-jwt
+func TestErrorMissingPayloadJWS(t *testing.T) {
+	_, err := (&rawJSONWebSignature{}).sanitized()
+	if err == nil {
+		t.Error("was able to parse message with missing payload")
+	}
+	if !strings.Contains(err.Error(), "missing payload") {
+		t.Errorf("unexpected error message, should contain 'missing payload': %s", err)
+	}
+}
+
+// Test that a null value in the header doesn't panic
+func TestNullHeaderValue(t *testing.T) {
+	msg := `{
+   "payload":
+    "eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGF
+     tcGxlLmNvbS9pc19yb290Ijp0cnVlfQ",
+   "protected":"eyJhbGciOiJFUzI1NiIsIm5vbmNlIjpudWxsfQ",
+   "header":
+    {"kid":"e9bc097a-ce51-4036-9562-d2ade882db0d"},
+   "signature":
+    "DtEhU3ljbEg8L38VWAfUAqOyKAM6-Xx-F4GawxaepmXFCgfTjDxw5djxLa8IS
+     lSApmWQxfKTUJqPP3-Kg6NU1Q"
+  }`
+
+	defer func() {
+		if r := recover(); r != nil {
+			t.Errorf("ParseSigned panic'd when parsing a message with a null protected header value")
+		}
+	}()
+	ParseSigned(msg)
+}
+
+// Test for bug:
+// https://github.com/square/go-jose/issues/157
+func TestEmbedJWKBug(t *testing.T) {
+	signerKey := SigningKey{
+		Key: &JSONWebKey{
+			Key:   rsaTestKey,
+			KeyID: "rsa-test-key",
+		},
+		Algorithm: RS256,
+	}
+
+	signer, err := NewSigner(signerKey, &SignerOptions{EmbedJWK: true})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	signerNoEmbed, err := NewSigner(signerKey, &SignerOptions{EmbedJWK: false})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	jws, err := signer.Sign([]byte("Lorem ipsum dolor sit amet"))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	jwsNoEmbed, err := signerNoEmbed.Sign([]byte("Lorem ipsum dolor sit amet"))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// This used to panic with:
+	// json: error calling MarshalJSON for type *jose.JSONWebKey: square/go-jose: unknown key type '%!s(<nil>)'
+	output := jws.FullSerialize()
+	outputNoEmbed := jwsNoEmbed.FullSerialize()
+
+	// Expected output with embed set to true is a JWS with the public JWK embedded, with kid header empty.
+	// Expected output with embed set to false is that we set the kid header for key identification instead.
+	parsed, err := ParseSigned(output)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	parsedNoEmbed, err := ParseSigned(outputNoEmbed)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if parsed.Signatures[0].Header.KeyID != "" {
+		t.Error("expected kid field in protected header to be empty")
+	}
+	if parsed.Signatures[0].Header.JSONWebKey.KeyID != "rsa-test-key" {
+		t.Error("expected rsa-test-key to be kid in embedded JWK in protected header")
+	}
+	if parsedNoEmbed.Signatures[0].Header.KeyID != "rsa-test-key" {
+		t.Error("expected kid field in protected header to be rsa-test-key")
+	}
+	if parsedNoEmbed.Signatures[0].Header.JSONWebKey != nil {
+		t.Error("expected no embedded JWK to be present")
+	}
+}
+
+func TestJWSWithCertificateChain(t *testing.T) {
+	signerKey := SigningKey{
+		Key:       rsaTestKey,
+		Algorithm: RS256,
+	}
+
+	certs := []string{
+		// CN=TrustedSigner, signed by IntermediateCA
+		"MIIDLDCCAhSgAwIBAgIQNsV1i7m3kXGugqOQuuC7FzANBgkqhkiG9w0BAQsFADAZMRcwFQYDVQQDEw5JbnRlcm1lZGlhdGVDQTAeFw0xODAzMjgxODQzNDlaFw0zODAzMjgxODQzMDJaMBgxFjAUBgNVBAMTDVRydXN0ZWRTaWduZXIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDLpvmOEDRxzQJUKHLkLQSsFDo9eGnolSERa6fz1E1F4wmk6nieHqssPd28C6Vb1sHJFne/j93DXNrx7W9Gy9fQvWa+VNHfGuYAodaS2pyV4VUPWMXI2a+qjxW85orq34XtcHzU+qm+ekR5W06ypW+xewbXJW//P9ulrsv3bDoDFaiggHY/u3p5CRSB9mg+Pbpf6E/k/N85sFJUsRE9hzgwg27Kqhh6p3hP3QnA+0WZRcWhwG0gykoD6layRLCPVcxlTSUdpyStDiK8w2whLJQfixCBGLS3/tB/GKb726bxTQK72OLzIMtOo4ZMtTva7bcA2PRgwfRz7bJg4DXz7oHTAgMBAAGjcTBvMA4GA1UdDwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwHQYDVR0OBBYEFCpZEyJGAyK//NsYSSC4xkOqNnh3MB8GA1UdIwQYMBaAFMAYlq86RZzTWxLpYE7KTTM7DHOuMA0GCSqGSIb3DQEBCwUAA4IBAQBSIln6jPFkctPC17le0O+wkCStFOuqUM9cjwPuj4xBQ47RxmC0Pjv52N3TuVH7slmMykITQO/vVqQZguf+N5u4BCh223qWiu1muYBTfBPXCPgJjJ79bUL/dy9QEocOfPiIqTFC6xHKeSUCu6qi5jCPFynOaoVvlNPZEb2MR+QrkKVzg09aDEfk6J+wE6eH9+kNOtwvd/z2a2t2hterURtJEnYt7AQGviEpUf1gbHxCE9f3FW5iJGdgcshrk5ZwUfxvND2x4qFq2fYQRxNBnkO+TSYzwYoAItcGAUvlZFH+rdsq3N+UpRptXRkj5iMq59VlcXFOT675EkkNREgromWn",
+		// CN=IntermediateCA, signed by TrustedCA
+		"MIIEHTCCAgWgAwIBAgIQXzZsEQv0cvSRLJAkS9FmWTANBgkqhkiG9w0BAQsFADAUMRIwEAYDVQQDEwlUcnVzdGVkQ0EwHhcNMTgwMzI4MTg0MzMzWhcNMzgwMzI4MTg0MzAzWjAZMRcwFQYDVQQDEw5JbnRlcm1lZGlhdGVDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAN3aYpH/1yEYf/kHuHWyO3AO4tgwlYYLhCDT2GvaPdaEcqhe/VuYiqx3xY7IRDqsW2rau/OXgW6KzLHdRZHogK07hUj1Lfr7X+Oqbp22IV4ydyiL7jwK9AtVXvDuuv5ET+oRfV82j0uhyk0ueGD9r6C/h+6NTzHBD+3xo6Yuc0VkBfY5zIyhaFqlm1aRYvupDRjC/63uBgAlrGxy2LyiTMVnYMuxoJM5ahDepz3sqjuNWVyPhfGwIezjXuXRdEvlmWX05XLnsTdP4zu4fHq9Z7c3TKWWONM3z64ECAZmGQVfMAcEDX7qP0gZX5PCT+0WcvTgTWE4Q+WIh5AmYyxQ04cCAwEAAaNmMGQwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYEFMAYlq86RZzTWxLpYE7KTTM7DHOuMB8GA1UdIwQYMBaAFMvTapNJg0cAubXJjcUNWFjuTAIYMA0GCSqGSIb3DQEBCwUAA4ICAQBmYRpQoWEm5g16kwUrpwWrH7OIqqMtUhM1dcskECfki3/hcsV+MQRkGHLIItucYIWqs7oOQIglsyGcohAbnvE1PVtKKojUHC0lfbjgIenDPbvz15QB6A3KLDR82QbQGeGniACy924p66zlfPwHJbkMo5ZaqtNqI//EIa2YCpyyokhFXaSFmPWXXrTOCsEEsFJKsoSCH1KUpTcwACGkkilNseg1edZB6/lBDwybxVuY+dbUlHip3r5tFcP66Co3tKAaEcVY0AsZ/8GKwH+IM2AR6q7jdn9Gp2OX4E1ul9Wy+hW5GHMmfixkgTVwRowuKgkCPEKV2/Xy3k9rlSpnKr2NpYYq0mu6An9HYt8THQ+ewGZHwWufuDFDWuzlu7CxFOjpXLKv8qqVnwSFC91S3HsPAzPKLC9ZMEC+iQs2VkesOs0nFLZeMaMGAO5W6xiyQ5p94oo0bqa1XbmSV1bNp1HWuNEGIiZKrEUDxfYuDc6fC6hJZKsjJkMkBeadlQAlLcjIx1rDV171CKLLTxy/dT5kv4p9UrJlnleyMVG6S/3d6nX/WLSgZIMYbOwiZVVPlSrobuG38ULJMCSuxndxD0l+HahJaH8vYXuR67A0XT+bTEe305AI6A/9MEaRrActBnq6/OviQgBsKAvtTv1FmDbnpZsKeoFuwc3OPdTveQdCRA==",
+	}
+
+	testCases := []struct {
+		// Cert chain to embed in message
+		chain []string
+		// Intermediates & root certificate to verify against
+		intermediates []string
+		root          string
+		// Should this test case verify?
+		success bool
+	}{
+		{certs, nil, trustedCA, true},
+		{certs, []string{intermediateCA}, trustedCA, true},
+		{certs[0:1], nil, intermediateCA, true},
+		{certs[0:1], nil, trustedCA, false},
+		{[]string{}, nil, trustedCA, false},
+	}
+
+	for i, testCase := range testCases {
+		signer, err := NewSigner(signerKey, &SignerOptions{
+			ExtraHeaders: map[HeaderKey]interface{}{HeaderKey("x5c"): testCase.chain},
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		signed, err := signer.Sign([]byte("Lorem ipsum dolor sit amet"))
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		parsed, err := ParseSigned(signed.FullSerialize())
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		opts := x509.VerifyOptions{
+			DNSName: "TrustedSigner",
+			Roots:   x509.NewCertPool(),
+		}
+
+		ok := opts.Roots.AppendCertsFromPEM([]byte(testCase.root))
+		if !ok {
+			t.Fatal("failed to parse trusted root certificate")
+		}
+
+		if len(testCase.intermediates) > 0 {
+			opts.Intermediates = x509.NewCertPool()
+			for _, intermediate := range testCase.intermediates {
+				ok := opts.Intermediates.AppendCertsFromPEM([]byte(intermediate))
+				if !ok {
+					t.Fatal("failed to parse trusted root certificate")
+				}
+			}
+		}
+
+		chains, err := parsed.Signatures[0].Protected.Certificates(opts)
+		if testCase.success && (len(chains) == 0 || err != nil) {
+			t.Fatalf("failed to verify certificate chain for test case %d: %s", i, err)
+		}
+		if !testCase.success && (len(chains) != 0 && err == nil) {
+			t.Fatalf("incorrectly verified certificate chain for test case %d (should fail)", i)
+		}
+	}
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/jwt/builder.go b/vendor/gopkg.in/square/go-jose.v2/jwt/builder.go
new file mode 100644
index 0000000..686ec80
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/jwt/builder.go
@@ -0,0 +1,334 @@
+/*-
+ * Copyright 2016 Zbigniew Mandziejewicz
+ * Copyright 2016 Square, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package jwt
+
+import (
+	"bytes"
+	"reflect"
+
+	"gopkg.in/square/go-jose.v2/json"
+
+	"gopkg.in/square/go-jose.v2"
+)
+
+// Builder is a utility for making JSON Web Tokens. Calls can be chained, and
+// errors are accumulated until the final call to CompactSerialize/FullSerialize.
+type Builder interface {
+	// Claims encodes claims into JWE/JWS form. Multiple calls will merge claims
+	// into single JSON object. If you are passing private claims, make sure to set
+	// struct field tags to specify the name for the JSON key to be used when
+	// serializing.
+	Claims(i interface{}) Builder
+	// Token builds a JSONWebToken from provided data.
+	Token() (*JSONWebToken, error)
+	// FullSerialize serializes a token using the full serialization format.
+	FullSerialize() (string, error)
+	// CompactSerialize serializes a token using the compact serialization format.
+	CompactSerialize() (string, error)
+}
+
+// NestedBuilder is a utility for making Signed-Then-Encrypted JSON Web Tokens.
+// Calls can be chained, and errors are accumulated until final call to
+// CompactSerialize/FullSerialize.
+type NestedBuilder interface {
+	// Claims encodes claims into JWE/JWS form. Multiple calls will merge claims
+	// into single JSON object. If you are passing private claims, make sure to set
+	// struct field tags to specify the name for the JSON key to be used when
+	// serializing.
+	Claims(i interface{}) NestedBuilder
+	// Token builds a NestedJSONWebToken from provided data.
+	Token() (*NestedJSONWebToken, error)
+	// FullSerialize serializes a token using the full serialization format.
+	FullSerialize() (string, error)
+	// CompactSerialize serializes a token using the compact serialization format.
+	CompactSerialize() (string, error)
+}
+
+type builder struct {
+	payload map[string]interface{}
+	err     error
+}
+
+type signedBuilder struct {
+	builder
+	sig jose.Signer
+}
+
+type encryptedBuilder struct {
+	builder
+	enc jose.Encrypter
+}
+
+type nestedBuilder struct {
+	builder
+	sig jose.Signer
+	enc jose.Encrypter
+}
+
+// Signed creates builder for signed tokens.
+func Signed(sig jose.Signer) Builder {
+	return &signedBuilder{
+		sig: sig,
+	}
+}
+
+// Encrypted creates builder for encrypted tokens.
+func Encrypted(enc jose.Encrypter) Builder {
+	return &encryptedBuilder{
+		enc: enc,
+	}
+}
+
+// SignedAndEncrypted creates builder for signed-then-encrypted tokens.
+// ErrInvalidContentType will be returned if encrypter doesn't have JWT content type.
+func SignedAndEncrypted(sig jose.Signer, enc jose.Encrypter) NestedBuilder {
+	if contentType, _ := enc.Options().ExtraHeaders[jose.HeaderContentType].(jose.ContentType); contentType != "JWT" {
+		return &nestedBuilder{
+			builder: builder{
+				err: ErrInvalidContentType,
+			},
+		}
+	}
+	return &nestedBuilder{
+		sig: sig,
+		enc: enc,
+	}
+}
+
+func (b builder) claims(i interface{}) builder {
+	if b.err != nil {
+		return b
+	}
+
+	m, ok := i.(map[string]interface{})
+	switch {
+	case ok:
+		return b.merge(m)
+	case reflect.Indirect(reflect.ValueOf(i)).Kind() == reflect.Struct:
+		m, err := normalize(i)
+		if err != nil {
+			return builder{
+				err: err,
+			}
+		}
+		return b.merge(m)
+	default:
+		return builder{
+			err: ErrInvalidClaims,
+		}
+	}
+}
+
+func normalize(i interface{}) (map[string]interface{}, error) {
+	m := make(map[string]interface{})
+
+	raw, err := json.Marshal(i)
+	if err != nil {
+		return nil, err
+	}
+
+	d := json.NewDecoder(bytes.NewReader(raw))
+	d.UseNumber()
+
+	if err := d.Decode(&m); err != nil {
+		return nil, err
+	}
+
+	return m, nil
+}
+
+func (b *builder) merge(m map[string]interface{}) builder {
+	p := make(map[string]interface{})
+	for k, v := range b.payload {
+		p[k] = v
+	}
+	for k, v := range m {
+		p[k] = v
+	}
+
+	return builder{
+		payload: p,
+	}
+}
+
+func (b *builder) token(p func(interface{}) ([]byte, error), h []jose.Header) (*JSONWebToken, error) {
+	return &JSONWebToken{
+		payload: p,
+		Headers: h,
+	}, nil
+}
+
+func (b *signedBuilder) Claims(i interface{}) Builder {
+	return &signedBuilder{
+		builder: b.builder.claims(i),
+		sig:     b.sig,
+	}
+}
+
+func (b *signedBuilder) Token() (*JSONWebToken, error) {
+	sig, err := b.sign()
+	if err != nil {
+		return nil, err
+	}
+
+	h := make([]jose.Header, len(sig.Signatures))
+	for i, v := range sig.Signatures {
+		h[i] = v.Header
+	}
+
+	return b.builder.token(sig.Verify, h)
+}
+
+func (b *signedBuilder) CompactSerialize() (string, error) {
+	sig, err := b.sign()
+	if err != nil {
+		return "", err
+	}
+
+	return sig.CompactSerialize()
+}
+
+func (b *signedBuilder) FullSerialize() (string, error) {
+	sig, err := b.sign()
+	if err != nil {
+		return "", err
+	}
+
+	return sig.FullSerialize(), nil
+}
+
+func (b *signedBuilder) sign() (*jose.JSONWebSignature, error) {
+	if b.err != nil {
+		return nil, b.err
+	}
+
+	p, err := json.Marshal(b.payload)
+	if err != nil {
+		return nil, err
+	}
+
+	return b.sig.Sign(p)
+}
+
+func (b *encryptedBuilder) Claims(i interface{}) Builder {
+	return &encryptedBuilder{
+		builder: b.builder.claims(i),
+		enc:     b.enc,
+	}
+}
+
+func (b *encryptedBuilder) CompactSerialize() (string, error) {
+	enc, err := b.encrypt()
+	if err != nil {
+		return "", err
+	}
+
+	return enc.CompactSerialize()
+}
+
+func (b *encryptedBuilder) FullSerialize() (string, error) {
+	enc, err := b.encrypt()
+	if err != nil {
+		return "", err
+	}
+
+	return enc.FullSerialize(), nil
+}
+
+func (b *encryptedBuilder) Token() (*JSONWebToken, error) {
+	enc, err := b.encrypt()
+	if err != nil {
+		return nil, err
+	}
+
+	return b.builder.token(enc.Decrypt, []jose.Header{enc.Header})
+}
+
+func (b *encryptedBuilder) encrypt() (*jose.JSONWebEncryption, error) {
+	if b.err != nil {
+		return nil, b.err
+	}
+
+	p, err := json.Marshal(b.payload)
+	if err != nil {
+		return nil, err
+	}
+
+	return b.enc.Encrypt(p)
+}
+
+func (b *nestedBuilder) Claims(i interface{}) NestedBuilder {
+	return &nestedBuilder{
+		builder: b.builder.claims(i),
+		sig:     b.sig,
+		enc:     b.enc,
+	}
+}
+
+func (b *nestedBuilder) Token() (*NestedJSONWebToken, error) {
+	enc, err := b.signAndEncrypt()
+	if err != nil {
+		return nil, err
+	}
+
+	return &NestedJSONWebToken{
+		enc:     enc,
+		Headers: []jose.Header{enc.Header},
+	}, nil
+}
+
+func (b *nestedBuilder) CompactSerialize() (string, error) {
+	enc, err := b.signAndEncrypt()
+	if err != nil {
+		return "", err
+	}
+
+	return enc.CompactSerialize()
+}
+
+func (b *nestedBuilder) FullSerialize() (string, error) {
+	enc, err := b.signAndEncrypt()
+	if err != nil {
+		return "", err
+	}
+
+	return enc.FullSerialize(), nil
+}
+
+func (b *nestedBuilder) signAndEncrypt() (*jose.JSONWebEncryption, error) {
+	if b.err != nil {
+		return nil, b.err
+	}
+
+	p, err := json.Marshal(b.payload)
+	if err != nil {
+		return nil, err
+	}
+
+	sig, err := b.sig.Sign(p)
+	if err != nil {
+		return nil, err
+	}
+
+	p2, err := sig.CompactSerialize()
+	if err != nil {
+		return nil, err
+	}
+
+	return b.enc.Encrypt([]byte(p2))
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/jwt/builder_test.go b/vendor/gopkg.in/square/go-jose.v2/jwt/builder_test.go
new file mode 100644
index 0000000..8213c47
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/jwt/builder_test.go
@@ -0,0 +1,507 @@
+/*-
+ * Copyright 2016 Zbigniew Mandziejewicz
+ * Copyright 2016 Square, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package jwt
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/hex"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"io"
+	"reflect"
+	"sort"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"gopkg.in/square/go-jose.v2"
+	"gopkg.in/square/go-jose.v2/json"
+)
+
+type testClaims struct {
+	Subject string `json:"sub"`
+}
+
+type invalidMarshalClaims struct {
+}
+
+var errInvalidMarshalClaims = errors.New("Failed marshaling invalid claims.")
+
+func (c invalidMarshalClaims) MarshalJSON() ([]byte, error) {
+	return nil, errInvalidMarshalClaims
+}
+
+var sampleClaims = Claims{
+	Subject:  "42",
+	IssuedAt: NewNumericDate(time.Date(2016, 1, 1, 0, 0, 0, 0, time.UTC)),
+	Issuer:   "issuer",
+	Audience: Audience{"a1", "a2"},
+}
+
+type numberClaims struct {
+	Int   int64   `json:"int"`
+	Float float64 `json:"float"`
+}
+
+func TestIntegerAndFloatsNormalize(t *testing.T) {
+	c := numberClaims{1 << 60, 12345.6789}
+
+	normalized, err := normalize(c)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	ni, err := (normalized["int"].(json.Number)).Int64()
+	nf, err := (normalized["float"].(json.Number)).Float64()
+
+	if ni != c.Int {
+		t.Error(fmt.Sprintf("normalize failed to preserve int64 (got %v, wanted %v, type %s)", normalized["int"], c.Int, reflect.TypeOf(normalized["int"])))
+	}
+	if nf != c.Float {
+		t.Error(fmt.Sprintf("normalize failed to preserve float64 (got %v, wanted %v, type %s)", normalized["float"], c.Float, reflect.TypeOf(normalized["float"])))
+	}
+}
+
+func TestBuilderCustomClaimsNonPointer(t *testing.T) {
+	jwt, err := Signed(rsaSigner).Claims(testClaims{"foo"}).CompactSerialize()
+	require.NoError(t, err, "Error creating JWT.")
+
+	parsed, err := ParseSigned(jwt)
+	require.NoError(t, err, "Error parsing JWT.")
+
+	out := &testClaims{}
+	if assert.NoError(t, parsed.Claims(&testPrivRSAKey1.PublicKey, out), "Error unmarshaling claims.") {
+		assert.Equal(t, "foo", out.Subject)
+	}
+}
+
+func TestBuilderCustomClaimsPointer(t *testing.T) {
+	jwt, err := Signed(rsaSigner).Claims(&testClaims{"foo"}).CompactSerialize()
+	require.NoError(t, err, "Error creating JWT.")
+
+	parsed, err := ParseSigned(jwt)
+	require.NoError(t, err, "Error parsing JWT.")
+
+	out := &testClaims{}
+	if assert.NoError(t, parsed.Claims(&testPrivRSAKey1.PublicKey, out), "Error unmarshaling claims.") {
+		assert.Equal(t, "foo", out.Subject)
+	}
+}
+
+func TestBuilderMergeClaims(t *testing.T) {
+	jwt, err := Signed(rsaSigner).
+		Claims(&Claims{
+			Subject: "42",
+		}).
+		Claims(map[string]interface{}{
+			"Scopes": []string{"read:users"},
+		}).
+		CompactSerialize()
+	require.NoError(t, err, "Error creating JWT.")
+
+	parsed, err := ParseSigned(jwt)
+	require.NoError(t, err, "Error parsing JWT.")
+
+	out := make(map[string]interface{})
+	if assert.NoError(t, parsed.Claims(&testPrivRSAKey1.PublicKey, &out), "Error unmarshaling claims.") {
+		assert.Equal(t, map[string]interface{}{
+			"sub":    "42",
+			"Scopes": []interface{}{"read:users"},
+		}, out)
+	}
+
+	_, err = Signed(rsaSigner).Claims("invalid-claims").Claims(&testClaims{"foo"}).CompactSerialize()
+	assert.Equal(t, err, ErrInvalidClaims)
+
+	_, err = Signed(rsaSigner).Claims(&invalidMarshalClaims{}).CompactSerialize()
+	assert.EqualError(t, err, "json: error calling MarshalJSON for type *jwt.invalidMarshalClaims: Failed marshaling invalid claims.")
+}
+
+func TestSignedFullSerializeAndToken(t *testing.T) {
+	b := Signed(rsaSigner).Claims(&testClaims{"foo"})
+
+	jwt, err := b.FullSerialize()
+	require.NoError(t, err, "Error creating JWT.")
+	parsed, err := ParseSigned(jwt)
+	require.NoError(t, err, "Error parsing JWT.")
+	out := &testClaims{}
+	if assert.NoError(t, parsed.Claims(&testPrivRSAKey1.PublicKey, &out), "Error unmarshaling claims.") {
+		assert.Equal(t, &testClaims{
+			Subject: "foo",
+		}, out)
+	}
+
+	jwt2, err := b.Token()
+	require.NoError(t, err, "Error creating JWT.")
+	out2 := &testClaims{}
+	if assert.NoError(t, jwt2.Claims(&testPrivRSAKey1.PublicKey, &out2), "Error unmarshaling claims.") {
+		assert.Equal(t, &testClaims{
+			Subject: "foo",
+		}, out2)
+	}
+
+	b2 := Signed(rsaSigner).Claims(&invalidMarshalClaims{})
+	_, err = b2.FullSerialize()
+	require.EqualError(t, err, "json: error calling MarshalJSON for type *jwt.invalidMarshalClaims: Failed marshaling invalid claims.")
+	_, err = b2.Token()
+	require.EqualError(t, err, "json: error calling MarshalJSON for type *jwt.invalidMarshalClaims: Failed marshaling invalid claims.")
+}
+
+func TestEncryptedFullSerializeAndToken(t *testing.T) {
+	recipient := jose.Recipient{
+		Algorithm: jose.RSA1_5,
+		Key:       testPrivRSAKey1.Public(),
+	}
+	encrypter, err := jose.NewEncrypter(jose.A128CBC_HS256, recipient, nil)
+	require.NoError(t, err, "Error creating encrypter.")
+
+	b := Encrypted(encrypter).Claims(&testClaims{"foo"})
+
+	jwt, err := b.FullSerialize()
+	require.NoError(t, err, "Error creating JWT.")
+	parsed, err := ParseEncrypted(jwt)
+	require.NoError(t, err, "Error parsing JWT.")
+	out := &testClaims{}
+	if assert.NoError(t, parsed.Claims(testPrivRSAKey1, &out)) {
+		assert.Equal(t, &testClaims{
+			Subject: "foo",
+		}, out)
+	}
+
+	jwt2, err := b.Token()
+	require.NoError(t, err, "Error creating JWT.")
+	out2 := &testClaims{}
+	if assert.NoError(t, jwt2.Claims(testPrivRSAKey1, &out2)) {
+		assert.Equal(t, &testClaims{
+			Subject: "foo",
+		}, out2)
+	}
+
+	b2 := Encrypted(encrypter).Claims(&invalidMarshalClaims{})
+
+	_, err = b2.FullSerialize()
+	require.EqualError(t, err, "json: error calling MarshalJSON for type *jwt.invalidMarshalClaims: Failed marshaling invalid claims.")
+	_, err = b2.Token()
+	require.EqualError(t, err, "json: error calling MarshalJSON for type *jwt.invalidMarshalClaims: Failed marshaling invalid claims.")
+}
+
+func TestBuilderSignedAndEncrypted(t *testing.T) {
+	recipient := jose.Recipient{
+		Algorithm: jose.RSA1_5,
+		Key:       testPrivRSAKey1.Public(),
+	}
+	encrypter, err := jose.NewEncrypter(jose.A128CBC_HS256, recipient, (&jose.EncrypterOptions{}).WithContentType("JWT").WithType("JWT"))
+	require.NoError(t, err, "Error creating encrypter.")
+
+	jwt1, err := SignedAndEncrypted(rsaSigner, encrypter).Claims(&testClaims{"foo"}).Token()
+	require.NoError(t, err, "Error marshaling signed-then-encrypted token.")
+	if nested, err := jwt1.Decrypt(testPrivRSAKey1); assert.NoError(t, err, "Error decrypting signed-then-encrypted token.") {
+		out := &testClaims{}
+		assert.NoError(t, nested.Claims(&testPrivRSAKey1.PublicKey, out))
+		assert.Equal(t, &testClaims{"foo"}, out)
+	}
+
+	b := SignedAndEncrypted(rsaSigner, encrypter).Claims(&testClaims{"foo"})
+	tok1, err := b.CompactSerialize()
+	if assert.NoError(t, err) {
+		jwt, err := ParseSignedAndEncrypted(tok1)
+		if assert.NoError(t, err, "Error parsing signed-then-encrypted compact token.") {
+			if nested, err := jwt.Decrypt(testPrivRSAKey1); assert.NoError(t, err) {
+				out := &testClaims{}
+				assert.NoError(t, nested.Claims(&testPrivRSAKey1.PublicKey, out))
+				assert.Equal(t, &testClaims{"foo"}, out)
+			}
+		}
+	}
+
+	tok2, err := b.FullSerialize()
+	if assert.NoError(t, err) {
+		jwe, err := ParseSignedAndEncrypted(tok2)
+		if assert.NoError(t, err, "Error parsing signed-then-encrypted full token.") {
+			assert.Equal(t, []jose.Header{{
+				Algorithm: string(jose.RSA1_5),
+				ExtraHeaders: map[jose.HeaderKey]interface{}{
+					jose.HeaderType:        "JWT",
+					jose.HeaderContentType: "JWT",
+					"enc": "A128CBC-HS256",
+				},
+			}}, jwe.Headers)
+			if jws, err := jwe.Decrypt(testPrivRSAKey1); assert.NoError(t, err) {
+				assert.Equal(t, []jose.Header{{
+					Algorithm: string(jose.RS256),
+					ExtraHeaders: map[jose.HeaderKey]interface{}{
+						jose.HeaderType: "JWT",
+					},
+				}}, jws.Headers)
+				out := &testClaims{}
+				assert.NoError(t, jws.Claims(&testPrivRSAKey1.PublicKey, out))
+				assert.Equal(t, &testClaims{"foo"}, out)
+			}
+		}
+	}
+
+	b2 := SignedAndEncrypted(rsaSigner, encrypter).Claims(&invalidMarshalClaims{})
+	_, err = b2.CompactSerialize()
+	assert.EqualError(t, err, "json: error calling MarshalJSON for type *jwt.invalidMarshalClaims: Failed marshaling invalid claims.")
+	_, err = b2.FullSerialize()
+	assert.EqualError(t, err, "json: error calling MarshalJSON for type *jwt.invalidMarshalClaims: Failed marshaling invalid claims.")
+
+	encrypter2, err := jose.NewEncrypter(jose.A128CBC_HS256, recipient, nil)
+	require.NoError(t, err, "Error creating encrypter.")
+	_, err = SignedAndEncrypted(rsaSigner, encrypter2).CompactSerialize()
+	assert.EqualError(t, err, "square/go-jose/jwt: expected content type to be JWT (cty header)")
+}
+
+func TestBuilderHeadersSigner(t *testing.T) {
+	tests := []struct {
+		Keys   []*rsa.PrivateKey
+		Claims interface{}
+	}{
+		{
+			Keys:   []*rsa.PrivateKey{testPrivRSAKey1},
+			Claims: &Claims{Issuer: "foo"},
+		},
+		{
+			Keys:   []*rsa.PrivateKey{testPrivRSAKey1, testPrivRSAKey2},
+			Claims: &Claims{Issuer: "foo"},
+		},
+	}
+
+	for i, tc := range tests {
+		wantKeyIDs := make([]string, len(tc.Keys))
+		signingKeys := make([]jose.SigningKey, len(tc.Keys))
+
+		for j, key := range tc.Keys {
+			keyIDBytes := make([]byte, 20)
+			if _, err := io.ReadFull(rand.Reader, keyIDBytes); err != nil {
+				t.Fatalf("failed to read random bytes: %v", err)
+			}
+			keyID := hex.EncodeToString(keyIDBytes)
+
+			wantKeyIDs[j] = keyID
+			signingKeys[j] = jose.SigningKey{
+				Algorithm: jose.RS256,
+				Key: &jose.JSONWebKey{
+					KeyID:     keyID,
+					Algorithm: "RSA",
+					Key:       key,
+				},
+			}
+		}
+
+		signer, err := jose.NewMultiSigner(signingKeys, nil)
+		if err != nil {
+			t.Errorf("case %d: NewMultiSigner(): %v", i, err)
+			continue
+		}
+
+		var token string
+		if len(tc.Keys) == 1 {
+			token, err = Signed(signer).Claims(tc.Claims).CompactSerialize()
+		} else {
+			token, err = Signed(signer).Claims(tc.Claims).FullSerialize()
+		}
+		if err != nil {
+			t.Errorf("case %d: failed to create token: %v", i, err)
+			continue
+		}
+		jws, err := jose.ParseSigned(token)
+		if err != nil {
+			t.Errorf("case %d: parse signed: %v", i, err)
+			continue
+		}
+		gotKeyIDs := make([]string, len(jws.Signatures))
+		for i, sig := range jws.Signatures {
+			gotKeyIDs[i] = sig.Header.KeyID
+		}
+		sort.Strings(wantKeyIDs)
+		sort.Strings(gotKeyIDs)
+		if !reflect.DeepEqual(wantKeyIDs, gotKeyIDs) {
+			t.Errorf("case %d: wanted=%q got=%q", i, wantKeyIDs, gotKeyIDs)
+		}
+	}
+}
+
+func TestBuilderHeadersEncrypter(t *testing.T) {
+	key := testPrivRSAKey1
+	claims := &Claims{Issuer: "foo"}
+
+	keyIDBytes := make([]byte, 20)
+	if _, err := io.ReadFull(rand.Reader, keyIDBytes); err != nil {
+		t.Fatalf("failed to read random bytes: %v", err)
+	}
+	keyID := hex.EncodeToString(keyIDBytes)
+
+	wantKeyID := keyID
+	recipient := jose.Recipient{
+		Algorithm: jose.RSA1_5,
+		Key:       key.Public(),
+		KeyID:     keyID,
+	}
+
+	wantType := jose.ContentType("JWT")
+	encrypter, err := jose.NewEncrypter(jose.A128CBC_HS256, recipient, (&jose.EncrypterOptions{}).WithType(wantType))
+	require.NoError(t, err, "failed to create encrypter")
+
+	token, err := Encrypted(encrypter).Claims(claims).CompactSerialize()
+	require.NoError(t, err, "failed to create token")
+
+	jwe, err := jose.ParseEncrypted(token)
+	if assert.NoError(t, err, "error parsing encrypted token") {
+		assert.Equal(t, jose.Header{
+			ExtraHeaders: map[jose.HeaderKey]interface{}{
+				jose.HeaderType: string(wantType),
+				"enc":           "A128CBC-HS256",
+			},
+			Algorithm: string(jose.RSA1_5),
+			KeyID:     wantKeyID,
+		}, jwe.Header)
+	}
+}
+
+func BenchmarkMapClaims(b *testing.B) {
+	m := map[string]interface{}{
+		"sub": "42",
+		"iat": 1451606400,
+		"iss": "issuer",
+		"aud": []string{"a1", "a2"},
+	}
+
+	for i := 0; i < b.N; i++ {
+		Signed(rsaSigner).Claims(m)
+	}
+}
+
+func BenchmarkStructClaims(b *testing.B) {
+	for i := 0; i < b.N; i++ {
+		Signed(rsaSigner).Claims(sampleClaims)
+	}
+}
+
+func BenchmarkSignedCompactSerializeRSA(b *testing.B) {
+	tb := Signed(rsaSigner).Claims(sampleClaims)
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		tb.CompactSerialize()
+	}
+}
+
+func BenchmarkSignedCompactSerializeSHA(b *testing.B) {
+	tb := Signed(hmacSigner).Claims(sampleClaims)
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		tb.CompactSerialize()
+	}
+}
+
+func mustUnmarshalRSA(data string) *rsa.PrivateKey {
+	block, _ := pem.Decode([]byte(data))
+	if block == nil {
+		panic("failed to decode PEM data")
+	}
+	key, err := x509.ParsePKCS8PrivateKey(block.Bytes)
+	if err != nil {
+		panic("failed to parse RSA key: " + err.Error())
+	}
+	if key, ok := key.(*rsa.PrivateKey); ok {
+		return key
+	}
+	panic("key is not of type *rsa.PrivateKey")
+}
+
+func mustMakeSigner(alg jose.SignatureAlgorithm, k interface{}) jose.Signer {
+	sig, err := jose.NewSigner(jose.SigningKey{Algorithm: alg, Key: k}, (&jose.SignerOptions{}).WithType("JWT"))
+	if err != nil {
+		panic("failed to create signer:" + err.Error())
+	}
+
+	return sig
+}
+
+var (
+	sharedKey           = []byte("secret")
+	sharedEncryptionKey = []byte("itsa16bytesecret")
+
+	testPrivRSAKey1 = mustUnmarshalRSA(`-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDIHBvDHAr7jh8h
+xaqBCl11fjI9YZtdC5b3HtXTXZW3c2dIOImNUjffT8POP6p5OpzivmC1om7iOyuZ
+3nJjC9LT3zqqs3f2i5d4mImxEuqG6uWdryFfkp0uIv5VkjVO+iQWd6pDAPGP7r1Z
+foXCleyCtmyNH4JSkJneNPOk/4BxO8vcvRnCMT/Gv81IT6H+OQ6OovWOuJr8RX9t
+1wuCjC9ezZxeI9ONffhiO5FMrVh5H9LJTl3dPOVa4aEcOvgd45hBmvxAyXqf8daE
+6Kl2O7vQ4uwgnSTVXYIIjCjbepuersApIMGx/XPSgiU1K3Xtah/TBvep+S3VlwPc
+q/QH25S9AgMBAAECggEAe+y8XKYfPw4SxY1uPB+5JSwT3ON3nbWxtjSIYy9Pqp5z
+Vcx9kuFZ7JevQSk4X38m7VzM8282kC/ono+d8yy9Uayq3k/qeOqV0X9Vti1qxEbw
+ECkG1/MqGApfy4qSLOjINInDDV+mOWa2KJgsKgdCwuhKbVMYGB2ozG2qfYIlfvlY
+vLcBEpGWmswJHNmkcjTtGFIyJgPbsI6ndkkOeQbqQKAaadXtG1xUzH+vIvqaUl/l
+AkNf+p4qhPkHsoAWXf1qu9cYa2T8T+mEo79AwlgVC6awXQWNRTiyClDJC7cu6NBy
+ZHXCLFMbalzWF9qeI2OPaFX2x3IBWrbyDxcJ4TSdQQKBgQD/Fp/uQonMBh1h4Vi4
+HlxZdqSOArTitXValdLFGVJ23MngTGV/St4WH6eRp4ICfPyldsfcv6MZpNwNm1Rn
+lB5Gtpqpby1dsrOSfvVbY7U3vpLnd8+hJ/lT5zCYt5Eor46N6iWRkYWzNe4PixiF
+z1puGUvFCbZdeeACVrPLmW3JKQKBgQDI0y9WTf8ezKPbtap4UEE6yBf49ftohVGz
+p4iD6Ng1uqePwKahwoVXKOc179CjGGtW/UUBORAoKRmxdHajHq6LJgsBxpaARz21
+COPy99BUyp9ER5P8vYn63lC7Cpd/K7uyMjaz1DAzYBZIeVZHIw8O9wuGNJKjRFy9
+SZyD3V0ddQKBgFMdohrWH2QVEfnUnT3Q1rJn0BJdm2bLTWOosbZ7G72TD0xAWEnz
+sQ1wXv88n0YER6X6YADziEdQykq8s/HT91F/KkHO8e83zP8M0xFmGaQCOoelKEgQ
+aFMIX3NDTM7+9OoUwwz9Z50PE3SJFAJ1n7eEEoYvNfabQXxBl+/dHEKRAoGAPEvU
+EaiXacrtg8EWrssB2sFLGU/ZrTciIbuybFCT4gXp22pvXXAHEvVP/kzDqsRhLhwb
+BNP6OuSkNziNikpjA5pngZ/7fgZly54gusmW/m5bxWdsUl0iOXVYbeAvPlqGH2me
+LP4Pfs1hw17S/cbT9Z1NE31jbavP4HFikeD73SUCgYEArQfuudml6ei7XZ1Emjq8
+jZiD+fX6e6BD/ISatVnuyZmGj9wPFsEhY2BpLiAMQHMDIvH9nlKzsFvjkTPB86qG
+jCh3D67Os8eSBk5uRC6iW3Fc4DXvB5EFS0W9/15Sl+V5vXAcrNMpYS82OTSMG2Gt
+b9Ym/nxaqyTu0PxajXkKm5Q=
+-----END PRIVATE KEY-----`)
+
+	testPrivRSAKey2 = mustUnmarshalRSA(`-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCxJ09jkXZ5Okyq
+FrEKrs+GTzZRvoLziyzDTIZLJC6BVryau4gaFjuBG+pnm4z53oDP0XVnjFsx1mBw
+R6RHeXlXbxLXsMfJpMzU9I2SRen9DokpD187CAnjLOoN9QRl1h8CA+sqR5Jw9mdl
+mdaBKC99M9QYAPK3vGNfPC4soo8LDSBiemmt5raL4WSfoYh/6qg5rHUTymY28uxV
+ew3I9Yp+3ltIw+WlRDtW5l+MM5CSUofjj2zcgcG3LEuPtvyZ+CSObxxcZZugm9zc
+JdiazNyUxtX8yAj3Xg8Hde0jt0QDXv7A+U0KMVi9lX6PJEaNj4tOhOmQhJVMzAyr
+1W/bifZVAgMBAAECggEAduKnn21GMZLTUi4KP94SvNK55F/Sp7hVoPbhBNpSL1BT
+IBAMBV24LyvZwhAcqq8MiOrLPGNv6+EvNQqPD7xQl0GeRouHeCYVpDA+NdSfc8jm
+eVysjwQVBpTkudsdSW5JvuN8VRJVD2P8/a0gy+p4/C/k/Prd6DoQAiBz6FZrYoEd
+iYgIegHOMXWd4vzO3ENOWSIUI6ci7Aro+Y0Z75kfiVokAGhUcFgrZ58E82fBYh8I
+cxO20oMnucGrLicQzj536jx4wX3Cdd4jr9UVEJ9ZII1ldlp03nZlFLXqJH1547Aq
+ZM+3vVcBGoJ8T9ZQ4VDAL++0K2DLC9JkTARAYCEi/QKBgQDebIc1+2zblhQtVQ/e
+IbEErZcB7v+TkUoRoBfR0lj7bKBFJgRe37fgu1xf95/s63okdnOw/OuQqtGmgx/J
+TL3yULBdNcwTCRm41t+cqoGymjK0VRbqk6CWBId0E3r5TaCVWedk2JI2XwTvIJ1A
+eDiqfJeDHUD44yaonwbysj9ZDwKBgQDL5VQfTppVaJk2PXNwhAkRQklZ8RFmt/7p
+yA3dddQNdwMk4Fl8F7QuO1gBxDiHdnwIrlEOz6fTsM3LwIS+Q12P1vYFIhpo7HDB
+wvjfMwCPxBIS4jI28RgcAf0VbZ/+CHAm6bb9iDwsjXhh1J5oOm5VKnju6/rPH/QY
++md40pnSWwKBgBnKPbdNquafNUG4XjmkcHEZa6wGuU20CAGZLYnfuP+WLdM2wET7
+7cc6ElDyVnHTL/twXKPF/85rcBm9lH7zzgZ9wqVcKoh+gqQDDjSNNLKv3Hc6cojK
+i1E5vzb/Vz/290q5/PGdhv6U7+6GOpWSGwfxoGPMjY8OT5o3rkeP0XaTAoGBALLR
+GQmr4eZtqZDMK+XNpjYgsDvVE7HGRCW7cY17vNFiQruglloiX778BJ7n+7uxye3D
+EwuuSj15ncLHwKMsaW2w1GqEEi1azzjfSWxWSnPLPR6aifdtUfueMtsMHXio5dL6
+vaV0SXG5UI5b7eDy/bhrW0wOYRQtreIKGZz49jZpAoGBAIvxYngkLwmq6g6MmnAc
+YK4oT6YAm2wfSy2mzpEQP5r1igp1rN7T46o7FMUPDLS9wK3ESAaIYe01qT6Yftcc
+5qF+yiOGDTr9XQiHwe4BcyrNEMfUjDhDU5ao2gH8+t1VGr1KspLsUNbedrJwZsY4
+UCZVKEEDHzKfLO/iBgKjJQF7
+-----END PRIVATE KEY-----`)
+
+	rsaSigner  = mustMakeSigner(jose.RS256, testPrivRSAKey1)
+	hmacSigner = mustMakeSigner(jose.HS256, sharedKey)
+)
diff --git a/vendor/gopkg.in/square/go-jose.v2/jwt/claims.go b/vendor/gopkg.in/square/go-jose.v2/jwt/claims.go
new file mode 100644
index 0000000..50fb705
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/jwt/claims.go
@@ -0,0 +1,120 @@
+/*-
+ * Copyright 2016 Zbigniew Mandziejewicz
+ * Copyright 2016 Square, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package jwt
+
+import (
+	"strconv"
+	"time"
+
+	"gopkg.in/square/go-jose.v2/json"
+)
+
+// Claims represents public claim values (as specified in RFC 7519).
+type Claims struct {
+	Issuer    string       `json:"iss,omitempty"`
+	Subject   string       `json:"sub,omitempty"`
+	Audience  Audience     `json:"aud,omitempty"`
+	Expiry    *NumericDate `json:"exp,omitempty"`
+	NotBefore *NumericDate `json:"nbf,omitempty"`
+	IssuedAt  *NumericDate `json:"iat,omitempty"`
+	ID        string       `json:"jti,omitempty"`
+}
+
+// NumericDate represents date and time as the number of seconds since the
+// epoch, including leap seconds. Non-integer values can be represented
+// in the serialized format, but we round to the nearest second.
+type NumericDate int64
+
+// NewNumericDate constructs NumericDate from time.Time value.
+func NewNumericDate(t time.Time) *NumericDate {
+	if t.IsZero() {
+		return nil
+	}
+
+	// While RFC 7519 technically states that NumericDate values may be
+	// non-integer values, we don't bother serializing timestamps in
+	// claims with sub-second accurancy and just round to the nearest
+	// second instead. Not convined sub-second accuracy is useful here.
+	out := NumericDate(t.Unix())
+	return &out
+}
+
+// MarshalJSON serializes the given NumericDate into its JSON representation.
+func (n NumericDate) MarshalJSON() ([]byte, error) {
+	return []byte(strconv.FormatInt(int64(n), 10)), nil
+}
+
+// UnmarshalJSON reads a date from its JSON representation.
+func (n *NumericDate) UnmarshalJSON(b []byte) error {
+	s := string(b)
+
+	f, err := strconv.ParseFloat(s, 64)
+	if err != nil {
+		return ErrUnmarshalNumericDate
+	}
+
+	*n = NumericDate(f)
+	return nil
+}
+
+// Time returns time.Time representation of NumericDate.
+func (n *NumericDate) Time() time.Time {
+	if n == nil {
+		return time.Time{}
+	}
+	return time.Unix(int64(*n), 0)
+}
+
+// Audience represents the recipents that the token is intended for.
+type Audience []string
+
+// UnmarshalJSON reads an audience from its JSON representation.
+func (s *Audience) UnmarshalJSON(b []byte) error {
+	var v interface{}
+	if err := json.Unmarshal(b, &v); err != nil {
+		return err
+	}
+
+	switch v := v.(type) {
+	case string:
+		*s = []string{v}
+	case []interface{}:
+		a := make([]string, len(v))
+		for i, e := range v {
+			s, ok := e.(string)
+			if !ok {
+				return ErrUnmarshalAudience
+			}
+			a[i] = s
+		}
+		*s = a
+	default:
+		return ErrUnmarshalAudience
+	}
+
+	return nil
+}
+
+func (s Audience) Contains(v string) bool {
+	for _, a := range s {
+		if a == v {
+			return true
+		}
+	}
+	return false
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/jwt/claims_test.go b/vendor/gopkg.in/square/go-jose.v2/jwt/claims_test.go
new file mode 100644
index 0000000..f107bfc
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/jwt/claims_test.go
@@ -0,0 +1,115 @@
+/*-
+ * Copyright 2016 Zbigniew Mandziejewicz
+ * Copyright 2016 Square, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package jwt
+
+import (
+	"testing"
+	"time"
+
+	"gopkg.in/square/go-jose.v2/json"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestEncodeClaims(t *testing.T) {
+	now := time.Date(2016, 1, 1, 0, 0, 0, 0, time.UTC)
+
+	c := Claims{
+		Issuer:    "issuer",
+		Subject:   "subject",
+		Audience:  Audience{"a1", "a2"},
+		NotBefore: NewNumericDate(time.Time{}),
+		IssuedAt:  NewNumericDate(now),
+		Expiry:    NewNumericDate(now.Add(1 * time.Hour)),
+	}
+
+	b, err := json.Marshal(c)
+	assert.NoError(t, err)
+
+	expected := `{"iss":"issuer","sub":"subject","aud":["a1","a2"],"exp":1451610000,"iat":1451606400}`
+	assert.Equal(t, expected, string(b))
+}
+
+func TestDecodeClaims(t *testing.T) {
+	s := []byte(`{"iss":"issuer","sub":"subject","aud":["a1","a2"],"exp":1451610000,"iat":1451606400}`)
+	now := time.Date(2016, 1, 1, 0, 0, 0, 0, time.UTC)
+
+	c := Claims{}
+	if err := json.Unmarshal(s, &c); assert.NoError(t, err) {
+		assert.Equal(t, "issuer", c.Issuer)
+		assert.Equal(t, "subject", c.Subject)
+		assert.Equal(t, Audience{"a1", "a2"}, c.Audience)
+		assert.True(t, now.Equal(c.IssuedAt.Time()))
+		assert.True(t, now.Add(1*time.Hour).Equal(c.Expiry.Time()))
+	}
+
+	s2 := []byte(`{"aud": "a1"}`)
+	c2 := Claims{}
+	if err := json.Unmarshal(s2, &c2); assert.NoError(t, err) {
+		assert.Equal(t, Audience{"a1"}, c2.Audience)
+	}
+
+	invalid := []struct {
+		Raw string
+		Err error
+	}{
+		{`{"aud": 5}`, ErrUnmarshalAudience},
+		{`{"aud": ["foo", 5, "bar"]}`, ErrUnmarshalAudience},
+		{`{"exp": "invalid"}`, ErrUnmarshalNumericDate},
+	}
+
+	for _, v := range invalid {
+		c := Claims{}
+		assert.Equal(t, v.Err, json.Unmarshal([]byte(v.Raw), &c))
+	}
+}
+
+func TestNumericDate(t *testing.T) {
+	zeroDate := NewNumericDate(time.Time{})
+	assert.True(t, time.Time{}.Equal(zeroDate.Time()), "Expected derived time to be time.Time{}")
+
+	zeroDate2 := (*NumericDate)(nil)
+	assert.True(t, time.Time{}.Equal(zeroDate2.Time()), "Expected derived time to be time.Time{}")
+
+	nonZeroDate := NewNumericDate(time.Unix(0, 0))
+	expected := time.Date(1970, 1, 1, 0, 0, 0, 0, time.UTC)
+	assert.Truef(t, expected.Equal(nonZeroDate.Time()), "Expected derived time to be %s", expected)
+}
+
+func TestEncodeClaimsTimeValues(t *testing.T) {
+	now := time.Date(2016, 1, 1, 0, 0, 0, 0, time.UTC)
+
+	c := Claims{
+		NotBefore: NewNumericDate(time.Time{}),
+		IssuedAt:  NewNumericDate(time.Unix(0, 0)),
+		Expiry:    NewNumericDate(now),
+	}
+
+	b, err := json.Marshal(c)
+	assert.NoError(t, err)
+
+	expected := `{"exp":1451606400,"iat":0}`
+	assert.Equal(t, expected, string(b))
+
+	c2 := Claims{}
+	if err := json.Unmarshal(b, &c2); assert.NoError(t, err) {
+		assert.True(t, c.NotBefore.Time().Equal(c2.NotBefore.Time()))
+		assert.True(t, c.IssuedAt.Time().Equal(c2.IssuedAt.Time()))
+		assert.True(t, c.Expiry.Time().Equal(c2.Expiry.Time()))
+	}
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/jwt/doc.go b/vendor/gopkg.in/square/go-jose.v2/jwt/doc.go
new file mode 100644
index 0000000..4cf97b5
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/jwt/doc.go
@@ -0,0 +1,22 @@
+/*-
+ * Copyright 2017 Square Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
+
+Package jwt provides an implementation of the JSON Web Token standard.
+
+*/
+package jwt
diff --git a/vendor/gopkg.in/square/go-jose.v2/jwt/errors.go b/vendor/gopkg.in/square/go-jose.v2/jwt/errors.go
new file mode 100644
index 0000000..09f76ae
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/jwt/errors.go
@@ -0,0 +1,53 @@
+/*-
+ * Copyright 2016 Zbigniew Mandziejewicz
+ * Copyright 2016 Square, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package jwt
+
+import "errors"
+
+// ErrUnmarshalAudience indicates that aud claim could not be unmarshalled.
+var ErrUnmarshalAudience = errors.New("square/go-jose/jwt: expected string or array value to unmarshal to Audience")
+
+// ErrUnmarshalNumericDate indicates that JWT NumericDate could not be unmarshalled.
+var ErrUnmarshalNumericDate = errors.New("square/go-jose/jwt: expected number value to unmarshal NumericDate")
+
+// ErrInvalidClaims indicates that given claims have invalid type.
+var ErrInvalidClaims = errors.New("square/go-jose/jwt: expected claims to be value convertible into JSON object")
+
+// ErrInvalidIssuer indicates invalid iss claim.
+var ErrInvalidIssuer = errors.New("square/go-jose/jwt: validation failed, invalid issuer claim (iss)")
+
+// ErrInvalidSubject indicates invalid sub claim.
+var ErrInvalidSubject = errors.New("square/go-jose/jwt: validation failed, invalid subject claim (sub)")
+
+// ErrInvalidAudience indicated invalid aud claim.
+var ErrInvalidAudience = errors.New("square/go-jose/jwt: validation failed, invalid audience claim (aud)")
+
+// ErrInvalidID indicates invalid jti claim.
+var ErrInvalidID = errors.New("square/go-jose/jwt: validation failed, invalid ID claim (jti)")
+
+// ErrNotValidYet indicates that token is used before time indicated in nbf claim.
+var ErrNotValidYet = errors.New("square/go-jose/jwt: validation failed, token not valid yet (nbf)")
+
+// ErrExpired indicates that token is used after expiry time indicated in exp claim.
+var ErrExpired = errors.New("square/go-jose/jwt: validation failed, token is expired (exp)")
+
+// ErrIssuedInTheFuture indicates that the iat field is in the future.
+var ErrIssuedInTheFuture = errors.New("square/go-jose/jwt: validation field, token issued in the future (iat)")
+
+// ErrInvalidContentType indicates that token requires JWT cty header.
+var ErrInvalidContentType = errors.New("square/go-jose/jwt: expected content type to be JWT (cty header)")
diff --git a/vendor/gopkg.in/square/go-jose.v2/jwt/example_test.go b/vendor/gopkg.in/square/go-jose.v2/jwt/example_test.go
new file mode 100644
index 0000000..bebe64d
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/jwt/example_test.go
@@ -0,0 +1,340 @@
+/*-
+ * Copyright 2016 Zbigniew Mandziejewicz
+ * Copyright 2016 Square, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package jwt_test
+
+import (
+	"fmt"
+	"strings"
+	"time"
+
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/pem"
+
+	"gopkg.in/square/go-jose.v2"
+	"gopkg.in/square/go-jose.v2/jwt"
+)
+
+var sharedKey = []byte("secret")
+var sharedEncryptionKey = []byte("itsa16bytesecret")
+var signer, _ = jose.NewSigner(jose.SigningKey{Algorithm: jose.HS256, Key: sharedKey}, &jose.SignerOptions{})
+
+func ExampleParseSigned() {
+	raw := `eyJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJpc3N1ZXIiLCJzdWIiOiJzdWJqZWN0In0.gpHyA1B1H6X4a4Edm9wo7D3X2v3aLSDBDG2_5BzXYe0`
+	tok, err := jwt.ParseSigned(raw)
+	if err != nil {
+		panic(err)
+	}
+
+	out := jwt.Claims{}
+	if err := tok.Claims(sharedKey, &out); err != nil {
+		panic(err)
+	}
+	fmt.Printf("iss: %s, sub: %s\n", out.Issuer, out.Subject)
+	// Output: iss: issuer, sub: subject
+}
+
+func ExampleParseEncrypted() {
+	key := []byte("itsa16bytesecret")
+	raw := `eyJhbGciOiJkaXIiLCJlbmMiOiJBMTI4R0NNIn0..jg45D9nmr6-8awml.z-zglLlEw9MVkYHi-Znd9bSwc-oRGbqKzf9WjXqZxno.kqji2DiZHZmh-1bLF6ARPw`
+	tok, err := jwt.ParseEncrypted(raw)
+	if err != nil {
+		panic(err)
+	}
+
+	out := jwt.Claims{}
+	if err := tok.Claims(key, &out); err != nil {
+		panic(err)
+	}
+	fmt.Printf("iss: %s, sub: %s\n", out.Issuer, out.Subject)
+	// Output: iss: issuer, sub: subject
+}
+
+func ExampleParseSignedAndEncrypted() {
+	raw := `eyJhbGciOiJkaXIiLCJlbmMiOiJBMTI4R0NNIiwiY3R5IjoiSldUIn0..-keV-9YpsxotBEHw.yC9SHWgnkjykgJqXZGlzYC5Wg_EdWKO5TgfqeqsWWJYw7fX9zXQE3NtXmA3nAiUrYOr3H2s0AgTeAhTNbELLEHQu0blfRaPa_uKOAgFgmhJwbGe2iFLn9J0U72wk56318nI-pTLCV8FijoGpXvAxQlaKrPLKkl9yDQimPhb7UiDwLWYkJeoayciAXhR5f40E8ORGjCz8oawXRvjDaSjgRElUwy4kMGzvJy_difemEh4lfMSIwUNVEqJkEYaalRttSymMYuV6NvBVU0N0Jb6omdM4tW961OySB4KPWCWH9UJUX0XSEcqbW9WLxpg3ftx5R7xNiCnaVaCx_gJZfXJ9yFLqztIrKh2N05zHM0tddSOwCOnq7_1rJtaVz0nTXjSjf1RrVaxJya59p3K-e41QutiGFiJGzXG-L2OyLETIaVSU3ptvaCz4IxCF3GzeCvOgaICvXkpBY1-bv-fk1ilyjmcTDnLp2KivWIxcnoQmpN9xj06ZjagdG09AHUhS5WixADAg8mIdGcanNblALecnCWG-otjM9Kw.RZoaHtSgnzOin2od3D9tnA`
+	tok, err := jwt.ParseSignedAndEncrypted(raw)
+	if err != nil {
+		panic(err)
+	}
+
+	nested, err := tok.Decrypt(sharedEncryptionKey)
+	if err != nil {
+		panic(err)
+	}
+
+	out := jwt.Claims{}
+	if err := nested.Claims(&rsaPrivKey.PublicKey, &out); err != nil {
+		panic(err)
+	}
+
+	fmt.Printf("iss: %s, sub: %s\n", out.Issuer, out.Subject)
+	// Output: iss: issuer, sub: subject
+}
+
+func ExampleClaims_Validate() {
+	cl := jwt.Claims{
+		Subject:   "subject",
+		Issuer:    "issuer",
+		NotBefore: jwt.NewNumericDate(time.Date(2016, 1, 1, 0, 0, 0, 0, time.UTC)),
+		Expiry:    jwt.NewNumericDate(time.Date(2016, 1, 1, 0, 15, 0, 0, time.UTC)),
+		Audience:  jwt.Audience{"leela", "fry"},
+	}
+
+	err := cl.Validate(jwt.Expected{
+		Issuer: "issuer",
+		Time:   time.Date(2016, 1, 1, 0, 10, 0, 0, time.UTC),
+	})
+	if err != nil {
+		panic(err)
+	}
+
+	fmt.Printf("valid!")
+	// Output: valid!
+}
+
+func ExampleClaims_Validate_withParse() {
+	raw := `eyJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJpc3N1ZXIiLCJzdWIiOiJzdWJqZWN0In0.gpHyA1B1H6X4a4Edm9wo7D3X2v3aLSDBDG2_5BzXYe0`
+	tok, err := jwt.ParseSigned(raw)
+	if err != nil {
+		panic(err)
+	}
+
+	cl := jwt.Claims{}
+	if err := tok.Claims(sharedKey, &cl); err != nil {
+		panic(err)
+	}
+
+	err = cl.Validate(jwt.Expected{
+		Issuer:  "issuer",
+		Subject: "subject",
+	})
+	if err != nil {
+		panic(err)
+	}
+
+	fmt.Printf("valid!")
+	// Output: valid!
+}
+
+func ExampleSigned() {
+	key := []byte("secret")
+	sig, err := jose.NewSigner(jose.SigningKey{Algorithm: jose.HS256, Key: key}, (&jose.SignerOptions{}).WithType("JWT"))
+	if err != nil {
+		panic(err)
+	}
+
+	cl := jwt.Claims{
+		Subject:   "subject",
+		Issuer:    "issuer",
+		NotBefore: jwt.NewNumericDate(time.Date(2016, 1, 1, 0, 0, 0, 0, time.UTC)),
+		Audience:  jwt.Audience{"leela", "fry"},
+	}
+	raw, err := jwt.Signed(sig).Claims(cl).CompactSerialize()
+	if err != nil {
+		panic(err)
+	}
+
+	fmt.Println(raw)
+	// Output: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOlsibGVlbGEiLCJmcnkiXSwiaXNzIjoiaXNzdWVyIiwibmJmIjoxNDUxNjA2NDAwLCJzdWIiOiJzdWJqZWN0In0.4PgCj0VO-uG_cb1mNA38NjJyp0N-NdGIDLoYelEkciw
+}
+
+func ExampleSigned_privateClaims() {
+	key := []byte("secret")
+	sig, err := jose.NewSigner(jose.SigningKey{Algorithm: jose.HS256, Key: key}, (&jose.SignerOptions{}).WithType("JWT"))
+	if err != nil {
+		panic(err)
+	}
+
+	cl := jwt.Claims{
+		Subject:   "subject",
+		Issuer:    "issuer",
+		NotBefore: jwt.NewNumericDate(time.Date(2016, 1, 1, 0, 0, 0, 0, time.UTC)),
+		Audience:  jwt.Audience{"leela", "fry"},
+	}
+
+	// When setting private claims, make sure to add struct tags
+	// to specify how to serialize the field. The naming behavior
+	// should match the encoding/json package otherwise.
+	privateCl := struct {
+		CustomClaim string `json:"custom"`
+	}{
+		"custom claim value",
+	}
+
+	raw, err := jwt.Signed(sig).Claims(cl).Claims(privateCl).CompactSerialize()
+	if err != nil {
+		panic(err)
+	}
+
+	fmt.Println(raw)
+	// Ouput: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOlsibGVlbGEiLCJmcnkiXSwiY3VzdG9tIjoiY3VzdG9tIGNsYWltIHZhbHVlIiwiaXNzIjoiaXNzdWVyIiwibmJmIjoxNDUxNjA2NDAwLCJzdWIiOiJzdWJqZWN0In0.knXH3ReNJToS5XI7BMCkk80ugpCup3tOy53xq-ga47o
+}
+
+func ExampleEncrypted() {
+	enc, err := jose.NewEncrypter(
+		jose.A128GCM,
+		jose.Recipient{Algorithm: jose.DIRECT, Key: sharedEncryptionKey},
+		(&jose.EncrypterOptions{}).WithType("JWT"),
+	)
+	if err != nil {
+		panic(err)
+	}
+
+	cl := jwt.Claims{
+		Subject: "subject",
+		Issuer:  "issuer",
+	}
+	raw, err := jwt.Encrypted(enc).Claims(cl).CompactSerialize()
+	if err != nil {
+		panic(err)
+	}
+
+	fmt.Println(raw)
+}
+
+func ExampleSignedAndEncrypted() {
+	enc, err := jose.NewEncrypter(
+		jose.A128GCM,
+		jose.Recipient{
+			Algorithm: jose.DIRECT,
+			Key:       sharedEncryptionKey,
+		},
+		(&jose.EncrypterOptions{}).WithType("JWT").WithContentType("JWT"))
+	if err != nil {
+		panic(err)
+	}
+
+	cl := jwt.Claims{
+		Subject: "subject",
+		Issuer:  "issuer",
+	}
+	raw, err := jwt.SignedAndEncrypted(rsaSigner, enc).Claims(cl).CompactSerialize()
+	if err != nil {
+		panic(err)
+	}
+
+	fmt.Println(raw)
+}
+
+func ExampleSigned_multipleClaims() {
+	c := &jwt.Claims{
+		Subject: "subject",
+		Issuer:  "issuer",
+	}
+	c2 := struct {
+		Scopes []string
+	}{
+		[]string{"foo", "bar"},
+	}
+	raw, err := jwt.Signed(signer).Claims(c).Claims(c2).CompactSerialize()
+	if err != nil {
+		panic(err)
+	}
+
+	fmt.Println(raw)
+	// Output: eyJhbGciOiJIUzI1NiJ9.eyJTY29wZXMiOlsiZm9vIiwiYmFyIl0sImlzcyI6Imlzc3VlciIsInN1YiI6InN1YmplY3QifQ.esKOIsmwkudr_gnfnB4SngxIr-7pspd5XzG3PImfQ6Y
+}
+
+func ExampleJSONWebToken_Claims_map() {
+	raw := `eyJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJpc3N1ZXIiLCJzdWIiOiJzdWJqZWN0In0.gpHyA1B1H6X4a4Edm9wo7D3X2v3aLSDBDG2_5BzXYe0`
+	tok, err := jwt.ParseSigned(raw)
+	if err != nil {
+		panic(err)
+	}
+
+	out := make(map[string]interface{})
+	if err := tok.Claims(sharedKey, &out); err != nil {
+		panic(err)
+	}
+
+	fmt.Printf("iss: %s, sub: %s\n", out["iss"], out["sub"])
+	// Output: iss: issuer, sub: subject
+}
+
+func ExampleJSONWebToken_Claims_multiple() {
+	raw := `eyJhbGciOiJIUzI1NiJ9.eyJTY29wZXMiOlsiZm9vIiwiYmFyIl0sImlzcyI6Imlzc3VlciIsInN1YiI6InN1YmplY3QifQ.esKOIsmwkudr_gnfnB4SngxIr-7pspd5XzG3PImfQ6Y`
+	tok, err := jwt.ParseSigned(raw)
+	if err != nil {
+		panic(err)
+	}
+
+	out := jwt.Claims{}
+	out2 := struct {
+		Scopes []string
+	}{}
+	if err := tok.Claims(sharedKey, &out, &out2); err != nil {
+		panic(err)
+	}
+	fmt.Printf("iss: %s, sub: %s, scopes: %s\n", out.Issuer, out.Subject, strings.Join(out2.Scopes, ","))
+	// Output: iss: issuer, sub: subject, scopes: foo,bar
+}
+
+func mustUnmarshalRSA(data string) *rsa.PrivateKey {
+	block, _ := pem.Decode([]byte(data))
+	if block == nil {
+		panic("failed to decode PEM data")
+	}
+	key, err := x509.ParsePKCS8PrivateKey(block.Bytes)
+	if err != nil {
+		panic("failed to parse RSA key: " + err.Error())
+	}
+	if key, ok := key.(*rsa.PrivateKey); ok {
+		return key
+	}
+	panic("key is not of type *rsa.PrivateKey")
+}
+
+func mustMakeSigner(alg jose.SignatureAlgorithm, k interface{}) jose.Signer {
+	sig, err := jose.NewSigner(jose.SigningKey{Algorithm: alg, Key: k}, nil)
+	if err != nil {
+		panic("failed to create signer:" + err.Error())
+	}
+
+	return sig
+}
+
+var rsaPrivKey = mustUnmarshalRSA(`-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDIHBvDHAr7jh8h
+xaqBCl11fjI9YZtdC5b3HtXTXZW3c2dIOImNUjffT8POP6p5OpzivmC1om7iOyuZ
+3nJjC9LT3zqqs3f2i5d4mImxEuqG6uWdryFfkp0uIv5VkjVO+iQWd6pDAPGP7r1Z
+foXCleyCtmyNH4JSkJneNPOk/4BxO8vcvRnCMT/Gv81IT6H+OQ6OovWOuJr8RX9t
+1wuCjC9ezZxeI9ONffhiO5FMrVh5H9LJTl3dPOVa4aEcOvgd45hBmvxAyXqf8daE
+6Kl2O7vQ4uwgnSTVXYIIjCjbepuersApIMGx/XPSgiU1K3Xtah/TBvep+S3VlwPc
+q/QH25S9AgMBAAECggEAe+y8XKYfPw4SxY1uPB+5JSwT3ON3nbWxtjSIYy9Pqp5z
+Vcx9kuFZ7JevQSk4X38m7VzM8282kC/ono+d8yy9Uayq3k/qeOqV0X9Vti1qxEbw
+ECkG1/MqGApfy4qSLOjINInDDV+mOWa2KJgsKgdCwuhKbVMYGB2ozG2qfYIlfvlY
+vLcBEpGWmswJHNmkcjTtGFIyJgPbsI6ndkkOeQbqQKAaadXtG1xUzH+vIvqaUl/l
+AkNf+p4qhPkHsoAWXf1qu9cYa2T8T+mEo79AwlgVC6awXQWNRTiyClDJC7cu6NBy
+ZHXCLFMbalzWF9qeI2OPaFX2x3IBWrbyDxcJ4TSdQQKBgQD/Fp/uQonMBh1h4Vi4
+HlxZdqSOArTitXValdLFGVJ23MngTGV/St4WH6eRp4ICfPyldsfcv6MZpNwNm1Rn
+lB5Gtpqpby1dsrOSfvVbY7U3vpLnd8+hJ/lT5zCYt5Eor46N6iWRkYWzNe4PixiF
+z1puGUvFCbZdeeACVrPLmW3JKQKBgQDI0y9WTf8ezKPbtap4UEE6yBf49ftohVGz
+p4iD6Ng1uqePwKahwoVXKOc179CjGGtW/UUBORAoKRmxdHajHq6LJgsBxpaARz21
+COPy99BUyp9ER5P8vYn63lC7Cpd/K7uyMjaz1DAzYBZIeVZHIw8O9wuGNJKjRFy9
+SZyD3V0ddQKBgFMdohrWH2QVEfnUnT3Q1rJn0BJdm2bLTWOosbZ7G72TD0xAWEnz
+sQ1wXv88n0YER6X6YADziEdQykq8s/HT91F/KkHO8e83zP8M0xFmGaQCOoelKEgQ
+aFMIX3NDTM7+9OoUwwz9Z50PE3SJFAJ1n7eEEoYvNfabQXxBl+/dHEKRAoGAPEvU
+EaiXacrtg8EWrssB2sFLGU/ZrTciIbuybFCT4gXp22pvXXAHEvVP/kzDqsRhLhwb
+BNP6OuSkNziNikpjA5pngZ/7fgZly54gusmW/m5bxWdsUl0iOXVYbeAvPlqGH2me
+LP4Pfs1hw17S/cbT9Z1NE31jbavP4HFikeD73SUCgYEArQfuudml6ei7XZ1Emjq8
+jZiD+fX6e6BD/ISatVnuyZmGj9wPFsEhY2BpLiAMQHMDIvH9nlKzsFvjkTPB86qG
+jCh3D67Os8eSBk5uRC6iW3Fc4DXvB5EFS0W9/15Sl+V5vXAcrNMpYS82OTSMG2Gt
+b9Ym/nxaqyTu0PxajXkKm5Q=
+-----END PRIVATE KEY-----`)
+
+var rsaSigner = mustMakeSigner(jose.RS256, rsaPrivKey)
diff --git a/vendor/gopkg.in/square/go-jose.v2/jwt/jwt.go b/vendor/gopkg.in/square/go-jose.v2/jwt/jwt.go
new file mode 100644
index 0000000..aa13d4f
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/jwt/jwt.go
@@ -0,0 +1,163 @@
+/*-
+ * Copyright 2016 Zbigniew Mandziejewicz
+ * Copyright 2016 Square, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package jwt
+
+import (
+	"fmt"
+	"strings"
+
+	jose "gopkg.in/square/go-jose.v2"
+	"gopkg.in/square/go-jose.v2/json"
+)
+
+// JSONWebToken represents a JSON Web Token (as specified in RFC7519).
+type JSONWebToken struct {
+	payload           func(k interface{}) ([]byte, error)
+	unverifiedPayload func() []byte
+	Headers           []jose.Header
+}
+
+type NestedJSONWebToken struct {
+	enc     *jose.JSONWebEncryption
+	Headers []jose.Header
+}
+
+// Claims deserializes a JSONWebToken into dest using the provided key.
+func (t *JSONWebToken) Claims(key interface{}, dest ...interface{}) error {
+	payloadKey := tryJWKS(t.Headers, key)
+
+	b, err := t.payload(payloadKey)
+	if err != nil {
+		return err
+	}
+
+	for _, d := range dest {
+		if err := json.Unmarshal(b, d); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// UnsafeClaimsWithoutVerification deserializes the claims of a
+// JSONWebToken into the dests. For signed JWTs, the claims are not
+// verified. This function won't work for encrypted JWTs.
+func (t *JSONWebToken) UnsafeClaimsWithoutVerification(dest ...interface{}) error {
+	if t.unverifiedPayload == nil {
+		return fmt.Errorf("square/go-jose: Cannot get unverified claims")
+	}
+	claims := t.unverifiedPayload()
+	for _, d := range dest {
+		if err := json.Unmarshal(claims, d); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (t *NestedJSONWebToken) Decrypt(decryptionKey interface{}) (*JSONWebToken, error) {
+	key := tryJWKS(t.Headers, decryptionKey)
+
+	b, err := t.enc.Decrypt(key)
+	if err != nil {
+		return nil, err
+	}
+
+	sig, err := ParseSigned(string(b))
+	if err != nil {
+		return nil, err
+	}
+
+	return sig, nil
+}
+
+// ParseSigned parses token from JWS form.
+func ParseSigned(s string) (*JSONWebToken, error) {
+	sig, err := jose.ParseSigned(s)
+	if err != nil {
+		return nil, err
+	}
+	headers := make([]jose.Header, len(sig.Signatures))
+	for i, signature := range sig.Signatures {
+		headers[i] = signature.Header
+	}
+
+	return &JSONWebToken{
+		payload:           sig.Verify,
+		unverifiedPayload: sig.UnsafePayloadWithoutVerification,
+		Headers:           headers,
+	}, nil
+}
+
+// ParseEncrypted parses token from JWE form.
+func ParseEncrypted(s string) (*JSONWebToken, error) {
+	enc, err := jose.ParseEncrypted(s)
+	if err != nil {
+		return nil, err
+	}
+
+	return &JSONWebToken{
+		payload: enc.Decrypt,
+		Headers: []jose.Header{enc.Header},
+	}, nil
+}
+
+// ParseSignedAndEncrypted parses signed-then-encrypted token from JWE form.
+func ParseSignedAndEncrypted(s string) (*NestedJSONWebToken, error) {
+	enc, err := jose.ParseEncrypted(s)
+	if err != nil {
+		return nil, err
+	}
+
+	contentType, _ := enc.Header.ExtraHeaders[jose.HeaderContentType].(string)
+	if strings.ToUpper(contentType) != "JWT" {
+		return nil, ErrInvalidContentType
+	}
+
+	return &NestedJSONWebToken{
+		enc:     enc,
+		Headers: []jose.Header{enc.Header},
+	}, nil
+}
+
+func tryJWKS(headers []jose.Header, key interface{}) interface{} {
+	jwks, ok := key.(*jose.JSONWebKeySet)
+	if !ok {
+		return key
+	}
+
+	var kid string
+	for _, header := range headers {
+		if header.KeyID != "" {
+			kid = header.KeyID
+			break
+		}
+	}
+
+	if kid == "" {
+		return key
+	}
+
+	keys := jwks.Key(kid)
+	if len(keys) == 0 {
+		return key
+	}
+
+	return keys[0].Key
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/jwt/jwt_test.go b/vendor/gopkg.in/square/go-jose.v2/jwt/jwt_test.go
new file mode 100644
index 0000000..97280cb
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/jwt/jwt_test.go
@@ -0,0 +1,217 @@
+/*-
+ * Copyright 2016 Zbigniew Mandziejewicz
+ * Copyright 2016 Square, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package jwt
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	jose "gopkg.in/square/go-jose.v2"
+)
+
+var (
+	hmacSignedToken                = `eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJzdWJqZWN0IiwiaXNzIjoiaXNzdWVyIiwic2NvcGVzIjpbInMxIiwiczIiXX0.Y6_PfQHrzRJ_Vlxij5VI07-pgDIuJNN3Z_g5sSaGQ0c`
+	rsaSignedToken                 = `eyJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJpc3N1ZXIiLCJzY29wZXMiOlsiczEiLCJzMiJdLCJzdWIiOiJzdWJqZWN0In0.UDDtyK9gC9kyHltcP7E_XODsnqcJWZIiXeGmSAH7SE9YKy3N0KSfFIN85dCNjTfs6zvy4rkrCHzLB7uKAtzMearh3q7jL4nxbhUMhlUcs_9QDVoN4q_j58XmRqBqRnBk-RmDu9TgcV8RbErP4awpIhwWb5UU-hR__4_iNbHdKqwSUPDKYGlf5eicuiYrPxH8mxivk4LRD-vyRdBZZKBt0XIDnEU4TdcNCzAXojkftqcFWYsczwS8R4JHd1qYsMyiaWl4trdHZkO4QkeLe34z4ZAaPMt3wE-gcU-VoqYTGxz-K3Le2VaZ0r3j_z6bOInsv0yngC_cD1dCXMyQJWnWjQ`
+	rsaSignedTokenWithKid          = `eyJhbGciOiJSUzI1NiIsImtpZCI6ImZvb2JhciJ9.eyJpc3MiOiJpc3N1ZXIiLCJzY29wZXMiOlsiczEiLCJzMiJdLCJzdWIiOiJzdWJqZWN0In0.RxZhTRfPDb6UJ58FwvC89GgJGC8lAO04tz5iLlBpIJsyPZB0X_UgXSj0SGVFm2jbP_i-ZVH4HFC2fMB1n-so9CnCOpunWwhYNdgF6ewQJ0ADTWwfDGsK12UOmyT2naaZN8ZUBF8cgPtOgdWqQjk2Ng9QFRJxlUuKYczBp7vjWvgX8WMwQcaA-eK7HtguR4e9c4FMbeFK8Soc4jCsVTjIKdSn9SErc42gFu65NI1hZ3OPe_T7AZqdDjCkJpoiJ65GdD_qvGkVndJSEcMp3riXQpAy0JbctVkYecdFaGidbxHRrdcQYHtKn-XGMCh2uoBKleUr1fTMiyCGPQQesy3xHw`
+	invalidPayloadSignedToken      = `eyJhbGciOiJIUzI1NiJ9.aW52YWxpZC1wYXlsb2Fk.ScBKKm18jcaMLGYDNRUqB5gVMRZl4DM6dh3ShcxeNgY`
+	invalidPartsSignedToken        = `eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJzdWJqZWN0IiwiaXNzIjoiaXNzdWVyIiwic2NvcGVzIjpbInMxIiwiczIiXX0`
+	hmacEncryptedToken             = `eyJhbGciOiJkaXIiLCJlbmMiOiJBMTI4R0NNIn0..NZrU98U4QNO0y-u6.HSq5CvlmkUT1BPqLGZ4.1-zuiZ4RbHrTTUoA8Dvfhg`
+	rsaEncryptedToken              = `eyJhbGciOiJSU0ExXzUiLCJlbmMiOiJBMTI4Q0JDLUhTMjU2In0.IvkVHHiI8JwwavvTR80xGjYvkzubMrZ-TDDx8k8SNJMEylfFfNUc7F2rC3WAABF_xmJ3SW2A6on-S6EAG97k0RsjqHHNqZuaFpDvjeuLqZFfYKzI45aCtkGG4C2ij2GbeySqJ784CcvFJPUWJ-6VPN2Ho2nhefUSqig0jE2IvOKy1ywTj_VBVBxF_dyXFnXwxPKGUQr3apxrWeRJfDh2Cf8YPBlLiRznjfBfwgePB1jP7WCZNwItj10L7hsT_YWEx01XJcbxHaXFLwKyVzwWaDhreFyaWMRbGqEfqVuOT34zfmhLDhQlgLLwkXrvYqX90NsQ9Ftg0LLIfRMbsfdgug.BFy2Tj1RZN8yq2Lk-kMiZQ.9Z0eOyPiv5cEzmXh64RlAQ36Uvz0WpZgqRcc2_69zHTmUOv0Vnl1I6ks8sTraUEvukAilolNBjBj47s0b4b-Og.VM8-eJg5ZsqnTqs0LtGX_Q`
+	invalidPayloadEncryptedToken   = `eyJhbGciOiJkaXIiLCJlbmMiOiJBMTI4R0NNIn0..T4jCS4Yyw1GCH0aW.y4gFaMITdBs_QZM8RKrL.6MPyk1cMVaOJFoNGlEuaRQ`
+	invalidPartsEncryptedToken     = `eyJhbGciOiJkaXIiLCJlbmMiOiJBMTI4R0NNIn0..NZrU98U4QNO0y-u6.HSq5CvlmkUT1BPqLGZ4`
+	signedAndEncryptedToken        = `eyJhbGciOiJSU0ExXzUiLCJlbmMiOiJBMTI4Q0JDLUhTMjU2IiwiY3R5IjoiSldUIn0.icnR7M1HSgMDaUnJhfzT5nLmT0eRPeNsKPkioNcyq9TZsm-LgbE7wZkNFGfQqYwvbmrZ3UpOhNkrq4n2KN3N1dtjH9TVxzfMxz2OMh0dRWUNMi58EMadhmIpH3PLyyaeDyd0dyHpOIRPFTAoOdn2GoO_flV5CvPMhgdVKYB3h3vQW-ZZDu4cOZwXAjTuThdoUZCNWFhJhXyj-PrKLyVpX6rE1o4X05IS8008SLZyx-PZlsUPyLs6CJi7Z4PzZRzOJTV00a-7UOi-fBKBZV5V8eRpWuzJ673pMALlRCBzrRin-JeEA_QnAejtMAHG7RSGP60easQN4I-0jLTQNNNynw.oFrO-5ZgRrnWmbkPsbyMiQ.BVaWUzlrdfhe0otPJpb3DGoDCT6-BOmN_Pgq5NOqVFYIAwG5pM4pf7TaiPUJeQLf0phbLgpT4RfJ20Zhwfc2MH5unCqc8TZEP2dOrYRhb8o-X57x6IQppIDbjK2i_CAWf3yF5JUB7qRqOizpKZTh3HFTVEglY3WF8tAJ8KpnatTUmwcnqlyjdBFvYu4usiyvc_u9wNbXx5-lFt0slQYleHQMUirBprKyswIBjMoFJEe7kDvU_MCKI4NI9_fSfWJpaUdNxQEvRYR1PV4ZQdwBY0X9u2n2QH5iVQMrmgmQ5hPbWxwRv1-7jXBMPBpGeFQZHeEtSwif1_Umwyt8cDyRChb3OM7XQ3eY0UJRrbmvhcLWIcMp8FpblDaBinbjD6qIVXZVmaAdIbi2a_HblfoeL3-UABb82AAxOqQcAFjDEDTR2TFalDXSwgPZrAaQ_Mql3eFe9r2y0UVkgG7XYF4ik8sSK48CkZPUvkZFr-K9QMq-RZLzT3Zw0edxNaKgje27S26H9qClh6CCr9nk38AZZ76_Xz7f-Fil5xI0Dq95UzvwW__U3JJWE6OVUVx_RVJgdOJn8_B7hluckwBLUblscA.83pPXNnH0sKgHvFboiJVDA`
+	invalidSignedAndEncryptedToken = `eyJhbGciOiJSU0ExXzUiLCJlbmMiOiJBMTI4Q0JDLUhTMjU2In0.QKYu3DkFEXBUa2U0Sgtm-e44BMuaFVbMu2T-GB3qEGONrmOuaB5BtNCvBUnuj6HR0v6u-tvawToRSzExQQLFTvPcLiQR8iclWirqAFUqLrg8kRU3qIRLkmErYeGIfCML1jq9ofKg0DI5-YrU5RSyUg9cwfXKEx8KNwFcjeVeDZwWEACdU8xBnQp57rNfr0Tj-dPnGKID7LU5ZV0vhK90FpEG7UqOeSHFmvONQyz6Ca-ZkE8X2swqGad-q5xl8f9pApdFqHzADox5OlgtxPkr-Khkm6WGfvf1K_e-iW5LYtvWIAjNByft2TexsNcYpdAO2oNAgh2nkhoohl-zCWU-og.UAU65JWKqvHZ_Z0V-xLyjQ.M6sQ4lAzKFelSmL6C6uoK00rB8IFCAK-eJ0iByGhtg8eYtmSBFsP_oUySfKPtxcPRkQ7YxnEX5D-DOo20wCV7il2Be9No__0R6_5heISOMXcKmKP3D6pFusaPisNGOgLw8SKXBuVpe20PvOJ9RgOXRKucSR2UMINXtqIn9RdxbKOlBBmMJhnX4TeQ00fRILng2sMbUHsWExSthQODHGx6VcwLFp-Aqmsnv2q2KkLpA8sEm48AHHFQXSGtlVGVgWKi3dOQYUnDJW4P64Xxr1Uq3yT7w_dRwK4BA7l3Biecj5dwkKrFMJ_RaCt-ED_R15zpxg6PmnXeeJnif58Fai40ZWOsGvLZNYwL1jbi-TrsargpdUQedfzuTk8Na2NkCzFNg2BYXVDHJ_WAX1daVyhvunaURwAlBatAcmnOGxWebwV1xQoQ7iHg6ZGohCannn_pqGwJlMHMgnCcnCIhwfj9uL9Ejz_TVceZNMlT1KvLRafVfxGhkp48bdnd8OcXmjT9pQzZUB3OqrstWKhbItZ1xMpy6dZ54ldWvtTTyQ4tQJaVWgXERUM1erDT6Ypyl15-fumOB9MRcgMG3NDblKowA.P9WTBITvVUgrLjX6bS0opQ`
+)
+
+type customClaims struct {
+	Scopes []string `json:"scopes,omitempty"`
+}
+
+func TestGetClaimsWithoutVerification(t *testing.T) {
+	tok, err := ParseSigned(hmacSignedToken)
+	if assert.NoError(t, err, "Error parsing signed token.") {
+		c := &Claims{}
+		c2 := &customClaims{}
+
+		err := tok.UnsafeClaimsWithoutVerification(c, c2)
+		if err != nil {
+			t.Errorf("Error not expected: %s", err)
+		}
+		assert.Equal(t, "subject", c.Subject)
+		assert.Equal(t, "issuer", c.Issuer)
+		assert.Equal(t, []string{"s1", "s2"}, c2.Scopes)
+
+	}
+	tok, err = ParseEncrypted(hmacEncryptedToken)
+	if assert.NoError(t, err, "Error parsing encrypted token.") {
+		c := Claims{}
+		err := tok.UnsafeClaimsWithoutVerification(c)
+		if err == nil {
+			t.Errorf("Error expected")
+		}
+	}
+}
+
+func TestDecodeTokenWithJWKS(t *testing.T) {
+	jwks := &jose.JSONWebKeySet{
+		Keys: []jose.JSONWebKey{
+			{
+				KeyID: "foobar",
+				Key:   &testPrivRSAKey1.PublicKey,
+			},
+		},
+	}
+
+	tok, err := ParseSigned(rsaSignedTokenWithKid)
+	if assert.NoError(t, err, "Error parsing signed token.") {
+		cl := make(map[string]interface{})
+		if assert.NoError(t, tok.Claims(jwks, &cl)) {
+			assert.Equal(t, map[string]interface{}{
+				"sub":    "subject",
+				"iss":    "issuer",
+				"scopes": []interface{}{"s1", "s2"},
+			}, cl)
+		}
+	}
+}
+
+func TestDecodeToken(t *testing.T) {
+	tok, err := ParseSigned(hmacSignedToken)
+	if assert.NoError(t, err, "Error parsing signed token.") {
+		c := &Claims{}
+		c2 := &customClaims{}
+		if assert.NoError(t, tok.Claims(sharedKey, c, c2)) {
+			assert.Equal(t, "subject", c.Subject)
+			assert.Equal(t, "issuer", c.Issuer)
+			assert.Equal(t, []string{"s1", "s2"}, c2.Scopes)
+		}
+	}
+	assert.EqualError(t, tok.Claims([]byte("invalid-secret")), "square/go-jose: error in cryptographic primitive")
+
+	tok2, err := ParseSigned(rsaSignedToken)
+	if assert.NoError(t, err, "Error parsing encrypted token.") {
+		c := make(map[string]interface{})
+		if assert.NoError(t, tok2.Claims(&testPrivRSAKey1.PublicKey, &c)) {
+			assert.Equal(t, map[string]interface{}{
+				"sub":    "subject",
+				"iss":    "issuer",
+				"scopes": []interface{}{"s1", "s2"},
+			}, c)
+		}
+	}
+	assert.EqualError(t, tok.Claims(&testPrivRSAKey2.PublicKey), "square/go-jose: error in cryptographic primitive")
+
+	tok3, err := ParseSigned(invalidPayloadSignedToken)
+	if assert.NoError(t, err, "Error parsing signed token.") {
+		assert.Error(t, tok3.Claims(sharedKey, &Claims{}), "Expected unmarshaling claims to fail.")
+	}
+
+	_, err = ParseSigned(invalidPartsSignedToken)
+	assert.EqualError(t, err, "square/go-jose: compact JWS format must have three parts")
+
+	tok4, err := ParseEncrypted(hmacEncryptedToken)
+	if assert.NoError(t, err, "Error parsing encrypted token.") {
+		c := Claims{}
+		if assert.NoError(t, tok4.Claims(sharedEncryptionKey, &c)) {
+			assert.Equal(t, "foo", c.Subject)
+		}
+	}
+	assert.EqualError(t, tok4.Claims([]byte("invalid-secret-key")), "square/go-jose: error in cryptographic primitive")
+
+	tok5, err := ParseEncrypted(rsaEncryptedToken)
+	if assert.NoError(t, err, "Error parsing encrypted token.") {
+		c := make(map[string]interface{})
+		if assert.NoError(t, tok5.Claims(testPrivRSAKey1, &c)) {
+			assert.Equal(t, map[string]interface{}{
+				"sub":    "subject",
+				"iss":    "issuer",
+				"scopes": []interface{}{"s1", "s2"},
+			}, c)
+		}
+	}
+	assert.EqualError(t, tok5.Claims(testPrivRSAKey2), "square/go-jose: error in cryptographic primitive")
+
+	tok6, err := ParseEncrypted(invalidPayloadEncryptedToken)
+	if assert.NoError(t, err, "Error parsing encrypted token.") {
+		assert.Error(t, tok6.Claims(sharedEncryptionKey, &Claims{}))
+	}
+
+	_, err = ParseEncrypted(invalidPartsEncryptedToken)
+	assert.EqualError(t, err, "square/go-jose: compact JWE format must have five parts")
+
+	tok7, err := ParseSignedAndEncrypted(signedAndEncryptedToken)
+	if assert.NoError(t, err, "Error parsing signed-then-encrypted token.") {
+		c := make(map[string]interface{})
+		if nested, err := tok7.Decrypt(testPrivRSAKey1); assert.NoError(t, err) {
+			assert.NoError(t, nested.Claims(testPrivRSAKey1.Public(), &c))
+			assert.Equal(t, map[string]interface{}{
+				"sub":    "subject",
+				"iss":    "issuer",
+				"scopes": []interface{}{"s1", "s2"},
+			}, c)
+			assert.EqualError(t, nested.Claims(testPrivRSAKey2.Public()), "square/go-jose: error in cryptographic primitive")
+		}
+	}
+	_, err = tok7.Decrypt(testPrivRSAKey2)
+	assert.EqualError(t, err, "square/go-jose: error in cryptographic primitive")
+
+	_, err = ParseSignedAndEncrypted(invalidSignedAndEncryptedToken)
+	assert.EqualError(t, err, "square/go-jose/jwt: expected content type to be JWT (cty header)")
+}
+
+func TestTamperedJWT(t *testing.T) {
+	key := []byte("1234567890123456")
+
+	sig, _ := jose.NewEncrypter(
+		jose.A128GCM,
+		jose.Recipient{Algorithm: jose.DIRECT, Key: key},
+		(&jose.EncrypterOptions{}).WithType("JWT"))
+
+	cl := Claims{
+		Subject: "foo",
+		Issuer:  "bar",
+	}
+
+	raw, _ := Encrypted(sig).Claims(cl).CompactSerialize()
+
+	// Modify with valid base64 junk
+	r := strings.Split(raw, ".")
+	r[2] = "b3RoZXJ0aGluZw"
+	raw = strings.Join(r, ".")
+
+	tok, _ := ParseEncrypted(raw)
+
+	cl = Claims{}
+	err := tok.Claims(key, &cl)
+	if err == nil {
+		t.Error("Claims() on invalid token should fail")
+	}
+}
+
+func BenchmarkDecodeSignedToken(b *testing.B) {
+	for i := 0; i < b.N; i++ {
+		ParseSigned(hmacSignedToken)
+	}
+}
+
+func BenchmarkDecodeEncryptedHMACToken(b *testing.B) {
+	for i := 0; i < b.N; i++ {
+		ParseEncrypted(hmacEncryptedToken)
+	}
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/jwt/validation.go b/vendor/gopkg.in/square/go-jose.v2/jwt/validation.go
new file mode 100644
index 0000000..045d5df
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/jwt/validation.go
@@ -0,0 +1,114 @@
+/*-
+ * Copyright 2016 Zbigniew Mandziejewicz
+ * Copyright 2016 Square, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package jwt
+
+import "time"
+
+const (
+	// DefaultLeeway defines the default leeway for matching NotBefore/Expiry claims.
+	DefaultLeeway = 1.0 * time.Minute
+)
+
+// Expected defines values used for protected claims validation.
+// If field has zero value then validation is skipped.
+type Expected struct {
+	// Issuer matches the "iss" claim exactly.
+	Issuer string
+	// Subject matches the "sub" claim exactly.
+	Subject string
+	// Audience matches the values in "aud" claim, regardless of their order.
+	Audience Audience
+	// ID matches the "jti" claim exactly.
+	ID string
+	// Time matches the "exp" and "nbf" claims with leeway.
+	Time time.Time
+}
+
+// WithTime copies expectations with new time.
+func (e Expected) WithTime(t time.Time) Expected {
+	e.Time = t
+	return e
+}
+
+// Validate checks claims in a token against expected values.
+// A default leeway value of one minute is used to compare time values.
+//
+// The default leeway will cause the token to be deemed valid until one
+// minute after the expiration time. If you're a server application that
+// wants to give an extra minute to client tokens, use this
+// function. If you're a client application wondering if the server
+// will accept your token, use ValidateWithLeeway with a leeway <=0,
+// otherwise this function might make you think a token is valid when
+// it is not.
+func (c Claims) Validate(e Expected) error {
+	return c.ValidateWithLeeway(e, DefaultLeeway)
+}
+
+// ValidateWithLeeway checks claims in a token against expected values. A
+// custom leeway may be specified for comparing time values. You may pass a
+// zero value to check time values with no leeway, but you should not that
+// numeric date values are rounded to the nearest second and sub-second
+// precision is not supported.
+//
+// The leeway gives some extra time to the token from the server's
+// point of view. That is, if the token is expired, ValidateWithLeeway
+// will still accept the token for 'leeway' amount of time. This fails
+// if you're using this function to check if a server will accept your
+// token, because it will think the token is valid even after it
+// expires. So if you're a client validating if the token is valid to
+// be submitted to a server, use leeway <=0, if you're a server
+// validation a token, use leeway >=0.
+func (c Claims) ValidateWithLeeway(e Expected, leeway time.Duration) error {
+	if e.Issuer != "" && e.Issuer != c.Issuer {
+		return ErrInvalidIssuer
+	}
+
+	if e.Subject != "" && e.Subject != c.Subject {
+		return ErrInvalidSubject
+	}
+
+	if e.ID != "" && e.ID != c.ID {
+		return ErrInvalidID
+	}
+
+	if len(e.Audience) != 0 {
+		for _, v := range e.Audience {
+			if !c.Audience.Contains(v) {
+				return ErrInvalidAudience
+			}
+		}
+	}
+
+	if !e.Time.IsZero() {
+		if c.NotBefore != nil && e.Time.Add(leeway).Before(c.NotBefore.Time()) {
+			return ErrNotValidYet
+		}
+
+		if c.Expiry != nil && e.Time.Add(-leeway).After(c.Expiry.Time()) {
+			return ErrExpired
+		}
+
+		// IssuedAt is optional but cannot be in the future. This is not required by the RFC, but
+		// something is misconfigured if this happens and we should not trust it.
+		if c.IssuedAt != nil && e.Time.Add(leeway).Before(c.IssuedAt.Time()) {
+			return ErrIssuedInTheFuture
+		}
+	}
+
+	return nil
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/jwt/validation_test.go b/vendor/gopkg.in/square/go-jose.v2/jwt/validation_test.go
new file mode 100644
index 0000000..6edcabd
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/jwt/validation_test.go
@@ -0,0 +1,167 @@
+/*-
+ * Copyright 2016 Zbigniew Mandziejewicz
+ * Copyright 2016 Square, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package jwt
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestFieldsMatch(t *testing.T) {
+	c := Claims{
+		Issuer:   "issuer",
+		Subject:  "subject",
+		Audience: []string{"a1", "a2"},
+		ID:       "42",
+	}
+
+	valid := []Expected{
+		{Issuer: "issuer"},
+		{Subject: "subject"},
+		{Audience: Audience{"a1", "a2"}},
+		{Audience: Audience{"a2", "a1"}},
+		{ID: "42"},
+	}
+
+	for _, v := range valid {
+		assert.NoError(t, c.Validate(v))
+	}
+
+	invalid := []struct {
+		Expected Expected
+		Error    error
+	}{
+		{Expected{Issuer: "invalid-issuer"}, ErrInvalidIssuer},
+		{Expected{Subject: "invalid-subject"}, ErrInvalidSubject},
+		{Expected{Audience: Audience{"invalid-audience"}}, ErrInvalidAudience},
+		{Expected{ID: "invalid-id"}, ErrInvalidID},
+	}
+
+	for _, v := range invalid {
+		assert.Equal(t, v.Error, c.Validate(v.Expected))
+	}
+}
+
+func TestExpiryAndNotBefore(t *testing.T) {
+	now := time.Date(2016, 1, 1, 12, 0, 0, 0, time.UTC)
+	twelveHoursAgo := now.Add(-12 * time.Hour)
+
+	c := Claims{
+		IssuedAt:  NewNumericDate(twelveHoursAgo),
+		NotBefore: NewNumericDate(twelveHoursAgo),
+		Expiry:    NewNumericDate(now),
+	}
+
+	// expired - default leeway (1 minute)
+	assert.NoError(t, c.Validate(Expected{Time: now}))
+	err := c.Validate(Expected{Time: now.Add(2 * DefaultLeeway)})
+	if assert.Error(t, err) {
+		assert.Equal(t, err, ErrExpired)
+	}
+
+	// expired - no leeway
+	assert.NoError(t, c.ValidateWithLeeway(Expected{Time: now}, 0))
+	err = c.ValidateWithLeeway(Expected{Time: now.Add(1 * time.Second)}, 0)
+	if assert.Error(t, err) {
+		assert.Equal(t, err, ErrExpired)
+	}
+
+	// not before - default leeway (1 minute)
+	assert.NoError(t, c.Validate(Expected{Time: twelveHoursAgo}))
+	err = c.Validate(Expected{Time: twelveHoursAgo.Add(-2 * DefaultLeeway)})
+	if assert.Error(t, err) {
+		assert.Equal(t, err, ErrNotValidYet)
+	}
+}
+
+func TestIssuedInFuture(t *testing.T) {
+	now := time.Date(2016, 1, 1, 12, 0, 0, 0, time.UTC)
+	oneHourInThePast := now.Add(-time.Hour)
+	oneHourInTheFuture := now.Add(time.Hour)
+
+	c := Claims{
+		IssuedAt:  NewNumericDate(now),
+		NotBefore: NewNumericDate(oneHourInThePast),
+		Expiry:    NewNumericDate(oneHourInTheFuture),
+	}
+
+	// defaults: valid right now, or in the future
+	assert.NoError(t, c.Validate(Expected{Time: now}))
+	assert.NoError(t, c.Validate(Expected{Time: now.Add(2 * DefaultLeeway)}))
+
+	// cannot be issued in the future
+	err := c.Validate(Expected{Time: now.Add(-2 * DefaultLeeway)})
+	if assert.Error(t, err) {
+		assert.Equal(t, err, ErrIssuedInTheFuture)
+	}
+	err = c.Validate(Expected{Time: now.Add(-DefaultLeeway - 1)})
+	if assert.Error(t, err) {
+		assert.Equal(t, err, ErrIssuedInTheFuture)
+	}
+
+	// valid when we are within the default leeway
+	assert.NoError(t, c.Validate(Expected{Time: now.Add(-DefaultLeeway)}))
+
+	// no leeway: valid up to the exact time; expired if issued one ns in the future
+	assert.NoError(t, c.ValidateWithLeeway(Expected{Time: now}, 0))
+	err = c.ValidateWithLeeway(Expected{Time: now.Add(-1)}, 0)
+	if assert.Error(t, err) {
+		assert.Equal(t, err, ErrIssuedInTheFuture)
+	}
+}
+
+func TestOptionalDateClaims(t *testing.T) {
+	var epoch time.Time
+
+	testCases := []struct {
+		name  string
+		claim Claims
+		want  error
+	}{
+		{
+			"no claims",
+			Claims{},
+			nil,
+		},
+		{
+			"fail nbf",
+			Claims{NotBefore: NewNumericDate(time.Now())},
+			ErrNotValidYet,
+		},
+		{
+			"fail exp",
+			Claims{Expiry: NewNumericDate(epoch.Add(-7 * 24 * time.Hour))},
+			ErrExpired,
+		},
+		{
+			"fail iat",
+			Claims{IssuedAt: NewNumericDate(time.Now())},
+			ErrIssuedInTheFuture,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			expect := Expected{}.WithTime(epoch.Add(-24 * time.Hour))
+			err := tc.claim.Validate(expect)
+			assert.Equal(t, tc.want, err)
+		})
+	}
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/opaque.go b/vendor/gopkg.in/square/go-jose.v2/opaque.go
new file mode 100644
index 0000000..4a8bd8f
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/opaque.go
@@ -0,0 +1,83 @@
+/*-
+ * Copyright 2018 Square Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package jose
+
+// OpaqueSigner is an interface that supports signing payloads with opaque
+// private key(s). Private key operations preformed by implementors may, for
+// example, occur in a hardware module. An OpaqueSigner may rotate signing keys
+// transparently to the user of this interface.
+type OpaqueSigner interface {
+	// Public returns the public key of the current signing key.
+	Public() *JSONWebKey
+	// Algs returns a list of supported signing algorithms.
+	Algs() []SignatureAlgorithm
+	// SignPayload signs a payload with the current signing key using the given
+	// algorithm.
+	SignPayload(payload []byte, alg SignatureAlgorithm) ([]byte, error)
+}
+
+type opaqueSigner struct {
+	signer OpaqueSigner
+}
+
+func newOpaqueSigner(alg SignatureAlgorithm, signer OpaqueSigner) (recipientSigInfo, error) {
+	var algSupported bool
+	for _, salg := range signer.Algs() {
+		if alg == salg {
+			algSupported = true
+			break
+		}
+	}
+	if !algSupported {
+		return recipientSigInfo{}, ErrUnsupportedAlgorithm
+	}
+
+	return recipientSigInfo{
+		sigAlg:    alg,
+		publicKey: signer.Public,
+		signer: &opaqueSigner{
+			signer: signer,
+		},
+	}, nil
+}
+
+func (o *opaqueSigner) signPayload(payload []byte, alg SignatureAlgorithm) (Signature, error) {
+	out, err := o.signer.SignPayload(payload, alg)
+	if err != nil {
+		return Signature{}, err
+	}
+
+	return Signature{
+		Signature: out,
+		protected: &rawHeader{},
+	}, nil
+}
+
+// OpaqueVerifier is an interface that supports verifying payloads with opaque
+// public key(s). An OpaqueSigner may rotate signing keys transparently to the
+// user of this interface.
+type OpaqueVerifier interface {
+	VerifyPayload(payload []byte, signature []byte, alg SignatureAlgorithm) error
+}
+
+type opaqueVerifier struct {
+	verifier OpaqueVerifier
+}
+
+func (o *opaqueVerifier) verifyPayload(payload []byte, signature []byte, alg SignatureAlgorithm) error {
+	return o.verifier.VerifyPayload(payload, signature, alg)
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/opaque_test.go b/vendor/gopkg.in/square/go-jose.v2/opaque_test.go
new file mode 100644
index 0000000..d6f7cc3
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/opaque_test.go
@@ -0,0 +1,192 @@
+/*-
+ * Copyright 2018 Square Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package jose
+
+import (
+	"fmt"
+	"testing"
+)
+
+type signWrapper struct {
+	pk      *JSONWebKey
+	wrapped payloadSigner
+	algs    []SignatureAlgorithm
+}
+
+var _ = OpaqueSigner(&signWrapper{})
+
+func (sw *signWrapper) Algs() []SignatureAlgorithm {
+	return sw.algs
+}
+
+func (sw *signWrapper) Public() *JSONWebKey {
+	return sw.pk
+}
+
+func (sw *signWrapper) SignPayload(payload []byte, alg SignatureAlgorithm) ([]byte, error) {
+	sig, err := sw.wrapped.signPayload(payload, alg)
+	if err != nil {
+		return nil, err
+	}
+	return sig.Signature, nil
+}
+
+type verifyWrapper struct {
+	wrapped []payloadVerifier
+}
+
+var _ = OpaqueVerifier(&verifyWrapper{})
+
+func (vw *verifyWrapper) VerifyPayload(payload []byte, signature []byte, alg SignatureAlgorithm) error {
+	if len(vw.wrapped) == 0 {
+		return fmt.Errorf("error: verifier had no keys")
+	}
+	var err error
+	for _, v := range vw.wrapped {
+		err = v.verifyPayload(payload, signature, alg)
+		if err == nil {
+			return nil
+		}
+	}
+	return err
+}
+
+func TestRoundtripsJWSOpaque(t *testing.T) {
+	sigAlgs := []SignatureAlgorithm{RS256, RS384, RS512, PS256, PS384, PS512, ES256, ES384, ES512, EdDSA}
+
+	serializers := []func(*JSONWebSignature) (string, error){
+		func(obj *JSONWebSignature) (string, error) { return obj.CompactSerialize() },
+		func(obj *JSONWebSignature) (string, error) { return obj.FullSerialize(), nil },
+	}
+
+	corrupter := func(obj *JSONWebSignature) {}
+
+	for _, alg := range sigAlgs {
+		signingKey, verificationKey := GenerateSigningTestKey(alg)
+
+		for i, serializer := range serializers {
+			sw := makeOpaqueSigner(t, signingKey, alg)
+			vw := makeOpaqueVerifier(t, []interface{}{verificationKey}, alg)
+
+			err := RoundtripJWS(alg, serializer, corrupter, sw, verificationKey, "test_nonce")
+			if err != nil {
+				t.Error(err, alg, i)
+			}
+
+			err = RoundtripJWS(alg, serializer, corrupter, signingKey, vw, "test_nonce")
+			if err != nil {
+				t.Error(err, alg, i)
+			}
+
+			err = RoundtripJWS(alg, serializer, corrupter, sw, vw, "test_nonce")
+			if err != nil {
+				t.Error(err, alg, i)
+			}
+		}
+	}
+}
+
+func makeOpaqueSigner(t *testing.T, signingKey interface{}, alg SignatureAlgorithm) *signWrapper {
+	ri, err := makeJWSRecipient(alg, signingKey)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return &signWrapper{
+		wrapped: ri.signer,
+		algs:    []SignatureAlgorithm{alg},
+		pk:      &JSONWebKey{Key: ri.publicKey()},
+	}
+}
+
+func makeOpaqueVerifier(t *testing.T, verificationKey []interface{}, alg SignatureAlgorithm) *verifyWrapper {
+	var verifiers []payloadVerifier
+	for _, vk := range verificationKey {
+		verifier, err := newVerifier(vk)
+		if err != nil {
+			t.Fatal(err)
+		}
+		verifiers = append(verifiers, verifier)
+	}
+	return &verifyWrapper{wrapped: verifiers}
+}
+
+func TestOpaqueSignerKeyRotation(t *testing.T) {
+
+	sigAlgs := []SignatureAlgorithm{RS256, RS384, RS512, PS256, PS384, PS512, ES256, ES384, ES512, EdDSA}
+
+	serializers := []func(*JSONWebSignature) (string, error){
+		func(obj *JSONWebSignature) (string, error) { return obj.CompactSerialize() },
+		func(obj *JSONWebSignature) (string, error) { return obj.FullSerialize(), nil },
+	}
+
+	for _, alg := range sigAlgs {
+		for i, serializer := range serializers {
+			sk1, pk1 := GenerateSigningTestKey(alg)
+			sk2, pk2 := GenerateSigningTestKey(alg)
+
+			sw := makeOpaqueSigner(t, sk1, alg)
+			sw.pk.KeyID = "first"
+			vw := makeOpaqueVerifier(t, []interface{}{pk1, pk2}, alg)
+
+			signer, err := NewSigner(
+				SigningKey{Algorithm: alg, Key: sw},
+				&SignerOptions{NonceSource: staticNonceSource("test_nonce")},
+			)
+			if err != nil {
+				t.Fatal(err, alg, i)
+			}
+
+			jws1, err := signer.Sign([]byte("foo bar baz"))
+			if err != nil {
+				t.Fatal(err, alg, i)
+			}
+			jws1 = rtSerialize(t, serializer, jws1, vw)
+			if kid := jws1.Signatures[0].Protected.KeyID; kid != "first" {
+				t.Errorf("expected kid %q but got %q", "first", kid)
+			}
+
+			swNext := makeOpaqueSigner(t, sk2, alg)
+			swNext.pk.KeyID = "next"
+			sw.wrapped = swNext.wrapped
+			sw.pk = swNext.pk
+
+			jws2, err := signer.Sign([]byte("foo bar baz next"))
+			if err != nil {
+				t.Error(err, alg, i)
+			}
+			jws2 = rtSerialize(t, serializer, jws2, vw)
+			if kid := jws2.Signatures[0].Protected.KeyID; kid != "next" {
+				t.Errorf("expected kid %q but got %q", "next", kid)
+			}
+		}
+	}
+}
+
+func rtSerialize(t *testing.T, serializer func(*JSONWebSignature) (string, error), sig *JSONWebSignature, vk interface{}) *JSONWebSignature {
+	b, err := serializer(sig)
+	if err != nil {
+		t.Fatal(err)
+	}
+	sig, err = ParseSigned(b)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := sig.Verify(vk); err != nil {
+		t.Fatal(err)
+	}
+	return sig
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/shared.go b/vendor/gopkg.in/square/go-jose.v2/shared.go
new file mode 100644
index 0000000..b0a6255
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/shared.go
@@ -0,0 +1,499 @@
+/*-
+ * Copyright 2014 Square Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package jose
+
+import (
+	"crypto/elliptic"
+	"crypto/x509"
+	"encoding/base64"
+	"errors"
+	"fmt"
+
+	"gopkg.in/square/go-jose.v2/json"
+)
+
+// KeyAlgorithm represents a key management algorithm.
+type KeyAlgorithm string
+
+// SignatureAlgorithm represents a signature (or MAC) algorithm.
+type SignatureAlgorithm string
+
+// ContentEncryption represents a content encryption algorithm.
+type ContentEncryption string
+
+// CompressionAlgorithm represents an algorithm used for plaintext compression.
+type CompressionAlgorithm string
+
+// ContentType represents type of the contained data.
+type ContentType string
+
+var (
+	// ErrCryptoFailure represents an error in cryptographic primitive. This
+	// occurs when, for example, a message had an invalid authentication tag or
+	// could not be decrypted.
+	ErrCryptoFailure = errors.New("square/go-jose: error in cryptographic primitive")
+
+	// ErrUnsupportedAlgorithm indicates that a selected algorithm is not
+	// supported. This occurs when trying to instantiate an encrypter for an
+	// algorithm that is not yet implemented.
+	ErrUnsupportedAlgorithm = errors.New("square/go-jose: unknown/unsupported algorithm")
+
+	// ErrUnsupportedKeyType indicates that the given key type/format is not
+	// supported. This occurs when trying to instantiate an encrypter and passing
+	// it a key of an unrecognized type or with unsupported parameters, such as
+	// an RSA private key with more than two primes.
+	ErrUnsupportedKeyType = errors.New("square/go-jose: unsupported key type/format")
+
+	// ErrInvalidKeySize indicates that the given key is not the correct size
+	// for the selected algorithm. This can occur, for example, when trying to
+	// encrypt with AES-256 but passing only a 128-bit key as input.
+	ErrInvalidKeySize = errors.New("square/go-jose: invalid key size for algorithm")
+
+	// ErrNotSupported serialization of object is not supported. This occurs when
+	// trying to compact-serialize an object which can't be represented in
+	// compact form.
+	ErrNotSupported = errors.New("square/go-jose: compact serialization not supported for object")
+
+	// ErrUnprotectedNonce indicates that while parsing a JWS or JWE object, a
+	// nonce header parameter was included in an unprotected header object.
+	ErrUnprotectedNonce = errors.New("square/go-jose: Nonce parameter included in unprotected header")
+)
+
+// Key management algorithms
+const (
+	ED25519            = KeyAlgorithm("ED25519")
+	RSA1_5             = KeyAlgorithm("RSA1_5")             // RSA-PKCS1v1.5
+	RSA_OAEP           = KeyAlgorithm("RSA-OAEP")           // RSA-OAEP-SHA1
+	RSA_OAEP_256       = KeyAlgorithm("RSA-OAEP-256")       // RSA-OAEP-SHA256
+	A128KW             = KeyAlgorithm("A128KW")             // AES key wrap (128)
+	A192KW             = KeyAlgorithm("A192KW")             // AES key wrap (192)
+	A256KW             = KeyAlgorithm("A256KW")             // AES key wrap (256)
+	DIRECT             = KeyAlgorithm("dir")                // Direct encryption
+	ECDH_ES            = KeyAlgorithm("ECDH-ES")            // ECDH-ES
+	ECDH_ES_A128KW     = KeyAlgorithm("ECDH-ES+A128KW")     // ECDH-ES + AES key wrap (128)
+	ECDH_ES_A192KW     = KeyAlgorithm("ECDH-ES+A192KW")     // ECDH-ES + AES key wrap (192)
+	ECDH_ES_A256KW     = KeyAlgorithm("ECDH-ES+A256KW")     // ECDH-ES + AES key wrap (256)
+	A128GCMKW          = KeyAlgorithm("A128GCMKW")          // AES-GCM key wrap (128)
+	A192GCMKW          = KeyAlgorithm("A192GCMKW")          // AES-GCM key wrap (192)
+	A256GCMKW          = KeyAlgorithm("A256GCMKW")          // AES-GCM key wrap (256)
+	PBES2_HS256_A128KW = KeyAlgorithm("PBES2-HS256+A128KW") // PBES2 + HMAC-SHA256 + AES key wrap (128)
+	PBES2_HS384_A192KW = KeyAlgorithm("PBES2-HS384+A192KW") // PBES2 + HMAC-SHA384 + AES key wrap (192)
+	PBES2_HS512_A256KW = KeyAlgorithm("PBES2-HS512+A256KW") // PBES2 + HMAC-SHA512 + AES key wrap (256)
+)
+
+// Signature algorithms
+const (
+	EdDSA = SignatureAlgorithm("EdDSA")
+	HS256 = SignatureAlgorithm("HS256") // HMAC using SHA-256
+	HS384 = SignatureAlgorithm("HS384") // HMAC using SHA-384
+	HS512 = SignatureAlgorithm("HS512") // HMAC using SHA-512
+	RS256 = SignatureAlgorithm("RS256") // RSASSA-PKCS-v1.5 using SHA-256
+	RS384 = SignatureAlgorithm("RS384") // RSASSA-PKCS-v1.5 using SHA-384
+	RS512 = SignatureAlgorithm("RS512") // RSASSA-PKCS-v1.5 using SHA-512
+	ES256 = SignatureAlgorithm("ES256") // ECDSA using P-256 and SHA-256
+	ES384 = SignatureAlgorithm("ES384") // ECDSA using P-384 and SHA-384
+	ES512 = SignatureAlgorithm("ES512") // ECDSA using P-521 and SHA-512
+	PS256 = SignatureAlgorithm("PS256") // RSASSA-PSS using SHA256 and MGF1-SHA256
+	PS384 = SignatureAlgorithm("PS384") // RSASSA-PSS using SHA384 and MGF1-SHA384
+	PS512 = SignatureAlgorithm("PS512") // RSASSA-PSS using SHA512 and MGF1-SHA512
+)
+
+// Content encryption algorithms
+const (
+	A128CBC_HS256 = ContentEncryption("A128CBC-HS256") // AES-CBC + HMAC-SHA256 (128)
+	A192CBC_HS384 = ContentEncryption("A192CBC-HS384") // AES-CBC + HMAC-SHA384 (192)
+	A256CBC_HS512 = ContentEncryption("A256CBC-HS512") // AES-CBC + HMAC-SHA512 (256)
+	A128GCM       = ContentEncryption("A128GCM")       // AES-GCM (128)
+	A192GCM       = ContentEncryption("A192GCM")       // AES-GCM (192)
+	A256GCM       = ContentEncryption("A256GCM")       // AES-GCM (256)
+)
+
+// Compression algorithms
+const (
+	NONE    = CompressionAlgorithm("")    // No compression
+	DEFLATE = CompressionAlgorithm("DEF") // DEFLATE (RFC 1951)
+)
+
+// A key in the protected header of a JWS object. Use of the Header...
+// constants is preferred to enhance type safety.
+type HeaderKey string
+
+const (
+	HeaderType        HeaderKey = "typ" // string
+	HeaderContentType           = "cty" // string
+
+	// These are set by go-jose and shouldn't need to be set by consumers of the
+	// library.
+	headerAlgorithm   = "alg"  // string
+	headerEncryption  = "enc"  // ContentEncryption
+	headerCompression = "zip"  // CompressionAlgorithm
+	headerCritical    = "crit" // []string
+
+	headerAPU = "apu" // *byteBuffer
+	headerAPV = "apv" // *byteBuffer
+	headerEPK = "epk" // *JSONWebKey
+	headerIV  = "iv"  // *byteBuffer
+	headerTag = "tag" // *byteBuffer
+	headerX5c = "x5c" // []*x509.Certificate
+
+	headerJWK   = "jwk"   // *JSONWebKey
+	headerKeyID = "kid"   // string
+	headerNonce = "nonce" // string
+
+	headerP2C = "p2c" // *byteBuffer (int)
+	headerP2S = "p2s" // *byteBuffer ([]byte)
+
+)
+
+// rawHeader represents the JOSE header for JWE/JWS objects (used for parsing).
+//
+// The decoding of the constituent items is deferred because we want to marshal
+// some members into particular structs rather than generic maps, but at the
+// same time we need to receive any extra fields unhandled by this library to
+// pass through to consuming code in case it wants to examine them.
+type rawHeader map[HeaderKey]*json.RawMessage
+
+// Header represents the read-only JOSE header for JWE/JWS objects.
+type Header struct {
+	KeyID      string
+	JSONWebKey *JSONWebKey
+	Algorithm  string
+	Nonce      string
+
+	// Unverified certificate chain parsed from x5c header.
+	certificates []*x509.Certificate
+
+	// Any headers not recognised above get unmarshaled
+	// from JSON in a generic manner and placed in this map.
+	ExtraHeaders map[HeaderKey]interface{}
+}
+
+// Certificates verifies & returns the certificate chain present
+// in the x5c header field of a message, if one was present. Returns
+// an error if there was no x5c header present or the chain could
+// not be validated with the given verify options.
+func (h Header) Certificates(opts x509.VerifyOptions) ([][]*x509.Certificate, error) {
+	if len(h.certificates) == 0 {
+		return nil, errors.New("square/go-jose: no x5c header present in message")
+	}
+
+	leaf := h.certificates[0]
+	if opts.Intermediates == nil {
+		opts.Intermediates = x509.NewCertPool()
+		for _, intermediate := range h.certificates[1:] {
+			opts.Intermediates.AddCert(intermediate)
+		}
+	}
+
+	return leaf.Verify(opts)
+}
+
+func (parsed rawHeader) set(k HeaderKey, v interface{}) error {
+	b, err := json.Marshal(v)
+	if err != nil {
+		return err
+	}
+
+	parsed[k] = makeRawMessage(b)
+	return nil
+}
+
+// getString gets a string from the raw JSON, defaulting to "".
+func (parsed rawHeader) getString(k HeaderKey) string {
+	v, ok := parsed[k]
+	if !ok || v == nil {
+		return ""
+	}
+	var s string
+	err := json.Unmarshal(*v, &s)
+	if err != nil {
+		return ""
+	}
+	return s
+}
+
+// getByteBuffer gets a byte buffer from the raw JSON. Returns (nil, nil) if
+// not specified.
+func (parsed rawHeader) getByteBuffer(k HeaderKey) (*byteBuffer, error) {
+	v := parsed[k]
+	if v == nil {
+		return nil, nil
+	}
+	var bb *byteBuffer
+	err := json.Unmarshal(*v, &bb)
+	if err != nil {
+		return nil, err
+	}
+	return bb, nil
+}
+
+// getAlgorithm extracts parsed "alg" from the raw JSON as a KeyAlgorithm.
+func (parsed rawHeader) getAlgorithm() KeyAlgorithm {
+	return KeyAlgorithm(parsed.getString(headerAlgorithm))
+}
+
+// getSignatureAlgorithm extracts parsed "alg" from the raw JSON as a SignatureAlgorithm.
+func (parsed rawHeader) getSignatureAlgorithm() SignatureAlgorithm {
+	return SignatureAlgorithm(parsed.getString(headerAlgorithm))
+}
+
+// getEncryption extracts parsed "enc" from the raw JSON.
+func (parsed rawHeader) getEncryption() ContentEncryption {
+	return ContentEncryption(parsed.getString(headerEncryption))
+}
+
+// getCompression extracts parsed "zip" from the raw JSON.
+func (parsed rawHeader) getCompression() CompressionAlgorithm {
+	return CompressionAlgorithm(parsed.getString(headerCompression))
+}
+
+func (parsed rawHeader) getNonce() string {
+	return parsed.getString(headerNonce)
+}
+
+// getEPK extracts parsed "epk" from the raw JSON.
+func (parsed rawHeader) getEPK() (*JSONWebKey, error) {
+	v := parsed[headerEPK]
+	if v == nil {
+		return nil, nil
+	}
+	var epk *JSONWebKey
+	err := json.Unmarshal(*v, &epk)
+	if err != nil {
+		return nil, err
+	}
+	return epk, nil
+}
+
+// getAPU extracts parsed "apu" from the raw JSON.
+func (parsed rawHeader) getAPU() (*byteBuffer, error) {
+	return parsed.getByteBuffer(headerAPU)
+}
+
+// getAPV extracts parsed "apv" from the raw JSON.
+func (parsed rawHeader) getAPV() (*byteBuffer, error) {
+	return parsed.getByteBuffer(headerAPV)
+}
+
+// getIV extracts parsed "iv" frpom the raw JSON.
+func (parsed rawHeader) getIV() (*byteBuffer, error) {
+	return parsed.getByteBuffer(headerIV)
+}
+
+// getTag extracts parsed "tag" frpom the raw JSON.
+func (parsed rawHeader) getTag() (*byteBuffer, error) {
+	return parsed.getByteBuffer(headerTag)
+}
+
+// getJWK extracts parsed "jwk" from the raw JSON.
+func (parsed rawHeader) getJWK() (*JSONWebKey, error) {
+	v := parsed[headerJWK]
+	if v == nil {
+		return nil, nil
+	}
+	var jwk *JSONWebKey
+	err := json.Unmarshal(*v, &jwk)
+	if err != nil {
+		return nil, err
+	}
+	return jwk, nil
+}
+
+// getCritical extracts parsed "crit" from the raw JSON. If omitted, it
+// returns an empty slice.
+func (parsed rawHeader) getCritical() ([]string, error) {
+	v := parsed[headerCritical]
+	if v == nil {
+		return nil, nil
+	}
+
+	var q []string
+	err := json.Unmarshal(*v, &q)
+	if err != nil {
+		return nil, err
+	}
+	return q, nil
+}
+
+// getS2C extracts parsed "p2c" from the raw JSON.
+func (parsed rawHeader) getP2C() (int, error) {
+	v := parsed[headerP2C]
+	if v == nil {
+		return 0, nil
+	}
+
+	var p2c int
+	err := json.Unmarshal(*v, &p2c)
+	if err != nil {
+		return 0, err
+	}
+	return p2c, nil
+}
+
+// getS2S extracts parsed "p2s" from the raw JSON.
+func (parsed rawHeader) getP2S() (*byteBuffer, error) {
+	return parsed.getByteBuffer(headerP2S)
+}
+
+// sanitized produces a cleaned-up header object from the raw JSON.
+func (parsed rawHeader) sanitized() (h Header, err error) {
+	for k, v := range parsed {
+		if v == nil {
+			continue
+		}
+		switch k {
+		case headerJWK:
+			var jwk *JSONWebKey
+			err = json.Unmarshal(*v, &jwk)
+			if err != nil {
+				err = fmt.Errorf("failed to unmarshal JWK: %v: %#v", err, string(*v))
+				return
+			}
+			h.JSONWebKey = jwk
+		case headerKeyID:
+			var s string
+			err = json.Unmarshal(*v, &s)
+			if err != nil {
+				err = fmt.Errorf("failed to unmarshal key ID: %v: %#v", err, string(*v))
+				return
+			}
+			h.KeyID = s
+		case headerAlgorithm:
+			var s string
+			err = json.Unmarshal(*v, &s)
+			if err != nil {
+				err = fmt.Errorf("failed to unmarshal algorithm: %v: %#v", err, string(*v))
+				return
+			}
+			h.Algorithm = s
+		case headerNonce:
+			var s string
+			err = json.Unmarshal(*v, &s)
+			if err != nil {
+				err = fmt.Errorf("failed to unmarshal nonce: %v: %#v", err, string(*v))
+				return
+			}
+			h.Nonce = s
+		case headerX5c:
+			c := []string{}
+			err = json.Unmarshal(*v, &c)
+			if err != nil {
+				err = fmt.Errorf("failed to unmarshal x5c header: %v: %#v", err, string(*v))
+				return
+			}
+			h.certificates, err = parseCertificateChain(c)
+			if err != nil {
+				err = fmt.Errorf("failed to unmarshal x5c header: %v: %#v", err, string(*v))
+				return
+			}
+		default:
+			if h.ExtraHeaders == nil {
+				h.ExtraHeaders = map[HeaderKey]interface{}{}
+			}
+			var v2 interface{}
+			err = json.Unmarshal(*v, &v2)
+			if err != nil {
+				err = fmt.Errorf("failed to unmarshal value: %v: %#v", err, string(*v))
+				return
+			}
+			h.ExtraHeaders[k] = v2
+		}
+	}
+	return
+}
+
+func parseCertificateChain(chain []string) ([]*x509.Certificate, error) {
+	out := make([]*x509.Certificate, len(chain))
+	for i, cert := range chain {
+		raw, err := base64.StdEncoding.DecodeString(cert)
+		if err != nil {
+			return nil, err
+		}
+		out[i], err = x509.ParseCertificate(raw)
+		if err != nil {
+			return nil, err
+		}
+	}
+	return out, nil
+}
+
+func (dst rawHeader) isSet(k HeaderKey) bool {
+	dvr := dst[k]
+	if dvr == nil {
+		return false
+	}
+
+	var dv interface{}
+	err := json.Unmarshal(*dvr, &dv)
+	if err != nil {
+		return true
+	}
+
+	if dvStr, ok := dv.(string); ok {
+		return dvStr != ""
+	}
+
+	return true
+}
+
+// Merge headers from src into dst, giving precedence to headers from l.
+func (dst rawHeader) merge(src *rawHeader) {
+	if src == nil {
+		return
+	}
+
+	for k, v := range *src {
+		if dst.isSet(k) {
+			continue
+		}
+
+		dst[k] = v
+	}
+}
+
+// Get JOSE name of curve
+func curveName(crv elliptic.Curve) (string, error) {
+	switch crv {
+	case elliptic.P256():
+		return "P-256", nil
+	case elliptic.P384():
+		return "P-384", nil
+	case elliptic.P521():
+		return "P-521", nil
+	default:
+		return "", fmt.Errorf("square/go-jose: unsupported/unknown elliptic curve")
+	}
+}
+
+// Get size of curve in bytes
+func curveSize(crv elliptic.Curve) int {
+	bits := crv.Params().BitSize
+
+	div := bits / 8
+	mod := bits % 8
+
+	if mod == 0 {
+		return div
+	}
+
+	return div + 1
+}
+
+func makeRawMessage(b []byte) *json.RawMessage {
+	rm := json.RawMessage(b)
+	return &rm
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/signing.go b/vendor/gopkg.in/square/go-jose.v2/signing.go
new file mode 100644
index 0000000..be6cf04
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/signing.go
@@ -0,0 +1,389 @@
+/*-
+ * Copyright 2014 Square Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package jose
+
+import (
+	"crypto/ecdsa"
+	"crypto/rsa"
+	"encoding/base64"
+	"errors"
+	"fmt"
+
+	"golang.org/x/crypto/ed25519"
+
+	"gopkg.in/square/go-jose.v2/json"
+)
+
+// NonceSource represents a source of random nonces to go into JWS objects
+type NonceSource interface {
+	Nonce() (string, error)
+}
+
+// Signer represents a signer which takes a payload and produces a signed JWS object.
+type Signer interface {
+	Sign(payload []byte) (*JSONWebSignature, error)
+	Options() SignerOptions
+}
+
+// SigningKey represents an algorithm/key used to sign a message.
+type SigningKey struct {
+	Algorithm SignatureAlgorithm
+	Key       interface{}
+}
+
+// SignerOptions represents options that can be set when creating signers.
+type SignerOptions struct {
+	NonceSource NonceSource
+	EmbedJWK    bool
+
+	// Optional map of additional keys to be inserted into the protected header
+	// of a JWS object. Some specifications which make use of JWS like to insert
+	// additional values here. All values must be JSON-serializable.
+	ExtraHeaders map[HeaderKey]interface{}
+}
+
+// WithHeader adds an arbitrary value to the ExtraHeaders map, initializing it
+// if necessary. It returns itself and so can be used in a fluent style.
+func (so *SignerOptions) WithHeader(k HeaderKey, v interface{}) *SignerOptions {
+	if so.ExtraHeaders == nil {
+		so.ExtraHeaders = map[HeaderKey]interface{}{}
+	}
+	so.ExtraHeaders[k] = v
+	return so
+}
+
+// WithContentType adds a content type ("cty") header and returns the updated
+// SignerOptions.
+func (so *SignerOptions) WithContentType(contentType ContentType) *SignerOptions {
+	return so.WithHeader(HeaderContentType, contentType)
+}
+
+// WithType adds a type ("typ") header and returns the updated SignerOptions.
+func (so *SignerOptions) WithType(typ ContentType) *SignerOptions {
+	return so.WithHeader(HeaderType, typ)
+}
+
+type payloadSigner interface {
+	signPayload(payload []byte, alg SignatureAlgorithm) (Signature, error)
+}
+
+type payloadVerifier interface {
+	verifyPayload(payload []byte, signature []byte, alg SignatureAlgorithm) error
+}
+
+type genericSigner struct {
+	recipients   []recipientSigInfo
+	nonceSource  NonceSource
+	embedJWK     bool
+	extraHeaders map[HeaderKey]interface{}
+}
+
+type recipientSigInfo struct {
+	sigAlg    SignatureAlgorithm
+	publicKey func() *JSONWebKey
+	signer    payloadSigner
+}
+
+func staticPublicKey(jwk *JSONWebKey) func() *JSONWebKey {
+	return func() *JSONWebKey {
+		return jwk
+	}
+}
+
+// NewSigner creates an appropriate signer based on the key type
+func NewSigner(sig SigningKey, opts *SignerOptions) (Signer, error) {
+	return NewMultiSigner([]SigningKey{sig}, opts)
+}
+
+// NewMultiSigner creates a signer for multiple recipients
+func NewMultiSigner(sigs []SigningKey, opts *SignerOptions) (Signer, error) {
+	signer := &genericSigner{recipients: []recipientSigInfo{}}
+
+	if opts != nil {
+		signer.nonceSource = opts.NonceSource
+		signer.embedJWK = opts.EmbedJWK
+		signer.extraHeaders = opts.ExtraHeaders
+	}
+
+	for _, sig := range sigs {
+		err := signer.addRecipient(sig.Algorithm, sig.Key)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	return signer, nil
+}
+
+// newVerifier creates a verifier based on the key type
+func newVerifier(verificationKey interface{}) (payloadVerifier, error) {
+	switch verificationKey := verificationKey.(type) {
+	case ed25519.PublicKey:
+		return &edEncrypterVerifier{
+			publicKey: verificationKey,
+		}, nil
+	case *rsa.PublicKey:
+		return &rsaEncrypterVerifier{
+			publicKey: verificationKey,
+		}, nil
+	case *ecdsa.PublicKey:
+		return &ecEncrypterVerifier{
+			publicKey: verificationKey,
+		}, nil
+	case []byte:
+		return &symmetricMac{
+			key: verificationKey,
+		}, nil
+	case JSONWebKey:
+		return newVerifier(verificationKey.Key)
+	case *JSONWebKey:
+		return newVerifier(verificationKey.Key)
+	}
+	if ov, ok := verificationKey.(OpaqueVerifier); ok {
+		return &opaqueVerifier{verifier: ov}, nil
+	}
+	return nil, ErrUnsupportedKeyType
+}
+
+func (ctx *genericSigner) addRecipient(alg SignatureAlgorithm, signingKey interface{}) error {
+	recipient, err := makeJWSRecipient(alg, signingKey)
+	if err != nil {
+		return err
+	}
+
+	ctx.recipients = append(ctx.recipients, recipient)
+	return nil
+}
+
+func makeJWSRecipient(alg SignatureAlgorithm, signingKey interface{}) (recipientSigInfo, error) {
+	switch signingKey := signingKey.(type) {
+	case ed25519.PrivateKey:
+		return newEd25519Signer(alg, signingKey)
+	case *rsa.PrivateKey:
+		return newRSASigner(alg, signingKey)
+	case *ecdsa.PrivateKey:
+		return newECDSASigner(alg, signingKey)
+	case []byte:
+		return newSymmetricSigner(alg, signingKey)
+	case JSONWebKey:
+		return newJWKSigner(alg, signingKey)
+	case *JSONWebKey:
+		return newJWKSigner(alg, *signingKey)
+	}
+	if signer, ok := signingKey.(OpaqueSigner); ok {
+		return newOpaqueSigner(alg, signer)
+	}
+	return recipientSigInfo{}, ErrUnsupportedKeyType
+}
+
+func newJWKSigner(alg SignatureAlgorithm, signingKey JSONWebKey) (recipientSigInfo, error) {
+	recipient, err := makeJWSRecipient(alg, signingKey.Key)
+	if err != nil {
+		return recipientSigInfo{}, err
+	}
+	if recipient.publicKey != nil && recipient.publicKey() != nil {
+		// recipient.publicKey is a JWK synthesized for embedding when recipientSigInfo
+		// was created for the inner key (such as a RSA or ECDSA public key). It contains
+		// the pub key for embedding, but doesn't have extra params like key id.
+		publicKey := signingKey
+		publicKey.Key = recipient.publicKey().Key
+		recipient.publicKey = staticPublicKey(&publicKey)
+
+		// This should be impossible, but let's check anyway.
+		if !recipient.publicKey().IsPublic() {
+			return recipientSigInfo{}, errors.New("square/go-jose: public key was unexpectedly not public")
+		}
+	}
+	return recipient, nil
+}
+
+func (ctx *genericSigner) Sign(payload []byte) (*JSONWebSignature, error) {
+	obj := &JSONWebSignature{}
+	obj.payload = payload
+	obj.Signatures = make([]Signature, len(ctx.recipients))
+
+	for i, recipient := range ctx.recipients {
+		protected := map[HeaderKey]interface{}{
+			headerAlgorithm: string(recipient.sigAlg),
+		}
+
+		if recipient.publicKey != nil && recipient.publicKey() != nil {
+			// We want to embed the JWK or set the kid header, but not both. Having a protected
+			// header that contains an embedded JWK while also simultaneously containing the kid
+			// header is confusing, and at least in ACME the two are considered to be mutually
+			// exclusive. The fact that both can exist at the same time is a somewhat unfortunate
+			// result of the JOSE spec. We've decided that this library will only include one or
+			// the other to avoid this confusion.
+			//
+			// See https://github.com/square/go-jose/issues/157 for more context.
+			if ctx.embedJWK {
+				protected[headerJWK] = recipient.publicKey()
+			} else {
+				protected[headerKeyID] = recipient.publicKey().KeyID
+			}
+		}
+
+		if ctx.nonceSource != nil {
+			nonce, err := ctx.nonceSource.Nonce()
+			if err != nil {
+				return nil, fmt.Errorf("square/go-jose: Error generating nonce: %v", err)
+			}
+			protected[headerNonce] = nonce
+		}
+
+		for k, v := range ctx.extraHeaders {
+			protected[k] = v
+		}
+
+		serializedProtected := mustSerializeJSON(protected)
+
+		input := []byte(fmt.Sprintf("%s.%s",
+			base64.RawURLEncoding.EncodeToString(serializedProtected),
+			base64.RawURLEncoding.EncodeToString(payload)))
+
+		signatureInfo, err := recipient.signer.signPayload(input, recipient.sigAlg)
+		if err != nil {
+			return nil, err
+		}
+
+		signatureInfo.protected = &rawHeader{}
+		for k, v := range protected {
+			b, err := json.Marshal(v)
+			if err != nil {
+				return nil, fmt.Errorf("square/go-jose: Error marshalling item %#v: %v", k, err)
+			}
+			(*signatureInfo.protected)[k] = makeRawMessage(b)
+		}
+		obj.Signatures[i] = signatureInfo
+	}
+
+	return obj, nil
+}
+
+func (ctx *genericSigner) Options() SignerOptions {
+	return SignerOptions{
+		NonceSource:  ctx.nonceSource,
+		EmbedJWK:     ctx.embedJWK,
+		ExtraHeaders: ctx.extraHeaders,
+	}
+}
+
+// Verify validates the signature on the object and returns the payload.
+// This function does not support multi-signature, if you desire multi-sig
+// verification use VerifyMulti instead.
+//
+// Be careful when verifying signatures based on embedded JWKs inside the
+// payload header. You cannot assume that the key received in a payload is
+// trusted.
+func (obj JSONWebSignature) Verify(verificationKey interface{}) ([]byte, error) {
+	err := obj.DetachedVerify(obj.payload, verificationKey)
+	if err != nil {
+		return nil, err
+	}
+	return obj.payload, nil
+}
+
+// UnsafePayloadWithoutVerification returns the payload without
+// verifying it. The content returned from this function cannot be
+// trusted.
+func (obj JSONWebSignature) UnsafePayloadWithoutVerification() []byte {
+	return obj.payload
+}
+
+// DetachedVerify validates a detached signature on the given payload. In
+// most cases, you will probably want to use Verify instead. DetachedVerify
+// is only useful if you have a payload and signature that are separated from
+// each other.
+func (obj JSONWebSignature) DetachedVerify(payload []byte, verificationKey interface{}) error {
+	verifier, err := newVerifier(verificationKey)
+	if err != nil {
+		return err
+	}
+
+	if len(obj.Signatures) > 1 {
+		return errors.New("square/go-jose: too many signatures in payload; expecting only one")
+	}
+
+	signature := obj.Signatures[0]
+	headers := signature.mergedHeaders()
+	critical, err := headers.getCritical()
+	if err != nil {
+		return err
+	}
+	if len(critical) > 0 {
+		// Unsupported crit header
+		return ErrCryptoFailure
+	}
+
+	input := obj.computeAuthData(payload, &signature)
+	alg := headers.getSignatureAlgorithm()
+	err = verifier.verifyPayload(input, signature.Signature, alg)
+	if err == nil {
+		return nil
+	}
+
+	return ErrCryptoFailure
+}
+
+// VerifyMulti validates (one of the multiple) signatures on the object and
+// returns the index of the signature that was verified, along with the signature
+// object and the payload. We return the signature and index to guarantee that
+// callers are getting the verified value.
+func (obj JSONWebSignature) VerifyMulti(verificationKey interface{}) (int, Signature, []byte, error) {
+	idx, sig, err := obj.DetachedVerifyMulti(obj.payload, verificationKey)
+	if err != nil {
+		return -1, Signature{}, nil, err
+	}
+	return idx, sig, obj.payload, nil
+}
+
+// DetachedVerifyMulti validates a detached signature on the given payload with
+// a signature/object that has potentially multiple signers. This returns the index
+// of the signature that was verified, along with the signature object. We return
+// the signature and index to guarantee that callers are getting the verified value.
+//
+// In most cases, you will probably want to use Verify or VerifyMulti instead.
+// DetachedVerifyMulti is only useful if you have a payload and signature that are
+// separated from each other, and the signature can have multiple signers at the
+// same time.
+func (obj JSONWebSignature) DetachedVerifyMulti(payload []byte, verificationKey interface{}) (int, Signature, error) {
+	verifier, err := newVerifier(verificationKey)
+	if err != nil {
+		return -1, Signature{}, err
+	}
+
+	for i, signature := range obj.Signatures {
+		headers := signature.mergedHeaders()
+		critical, err := headers.getCritical()
+		if err != nil {
+			continue
+		}
+		if len(critical) > 0 {
+			// Unsupported crit header
+			continue
+		}
+
+		input := obj.computeAuthData(payload, &signature)
+		alg := headers.getSignatureAlgorithm()
+		err = verifier.verifyPayload(input, signature.Signature, alg)
+		if err == nil {
+			return i, signature, nil
+		}
+	}
+
+	return -1, Signature{}, ErrCryptoFailure
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/signing_test.go b/vendor/gopkg.in/square/go-jose.v2/signing_test.go
new file mode 100644
index 0000000..256a4a2
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/signing_test.go
@@ -0,0 +1,523 @@
+/*-
+ * Copyright 2014 Square Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package jose
+
+import (
+	"bytes"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"fmt"
+	"io"
+	"reflect"
+	"testing"
+
+	"gopkg.in/square/go-jose.v2/json"
+)
+
+type staticNonceSource string
+
+func (sns staticNonceSource) Nonce() (string, error) {
+	return string(sns), nil
+}
+
+func RoundtripJWS(sigAlg SignatureAlgorithm, serializer func(*JSONWebSignature) (string, error), corrupter func(*JSONWebSignature), signingKey interface{}, verificationKey interface{}, nonce string) error {
+	opts := &SignerOptions{}
+	if nonce != "" {
+		opts.NonceSource = staticNonceSource(nonce)
+	}
+
+	signer, err := NewSigner(SigningKey{Algorithm: sigAlg, Key: signingKey}, opts)
+	if err != nil {
+		return fmt.Errorf("error on new signer: %s", err)
+	}
+
+	input := []byte("Lorem ipsum dolor sit amet")
+	obj, err := signer.Sign(input)
+	if err != nil {
+		return fmt.Errorf("error on sign: %s", err)
+	}
+
+	msg, err := serializer(obj)
+	if err != nil {
+		return fmt.Errorf("error on serialize: %s", err)
+	}
+
+	obj, err = ParseSigned(msg)
+	if err != nil {
+		return fmt.Errorf("error on parse: %s", err)
+	}
+
+	// (Maybe) mangle the object
+	corrupter(obj)
+
+	output, err := obj.Verify(verificationKey)
+	if err != nil {
+		return fmt.Errorf("error on verify: %s", err)
+	}
+
+	// Check that verify works with embedded keys (if present)
+	for i, sig := range obj.Signatures {
+		if sig.Header.JSONWebKey != nil {
+			_, err = obj.Verify(sig.Header.JSONWebKey)
+			if err != nil {
+				return fmt.Errorf("error on verify with embedded key %d: %s", i, err)
+			}
+		}
+
+		// Check that the nonce correctly round-tripped (if present)
+		if sig.Header.Nonce != nonce {
+			return fmt.Errorf("Incorrect nonce returned: [%s]", sig.Header.Nonce)
+		}
+	}
+
+	if bytes.Compare(output, input) != 0 {
+		return fmt.Errorf("input/output do not match, got '%s', expected '%s'", output, input)
+	}
+
+	return nil
+}
+
+func TestRoundtripsJWS(t *testing.T) {
+	// Test matrix
+	sigAlgs := []SignatureAlgorithm{RS256, RS384, RS512, PS256, PS384, PS512, HS256, HS384, HS512, ES256, ES384, ES512, EdDSA}
+
+	serializers := []func(*JSONWebSignature) (string, error){
+		func(obj *JSONWebSignature) (string, error) { return obj.CompactSerialize() },
+		func(obj *JSONWebSignature) (string, error) { return obj.FullSerialize(), nil },
+	}
+
+	corrupter := func(obj *JSONWebSignature) {}
+
+	for _, alg := range sigAlgs {
+		signingKey, verificationKey := GenerateSigningTestKey(alg)
+
+		for i, serializer := range serializers {
+			err := RoundtripJWS(alg, serializer, corrupter, signingKey, verificationKey, "test_nonce")
+			if err != nil {
+				t.Error(err, alg, i)
+			}
+		}
+	}
+}
+
+func TestRoundtripsJWSCorruptSignature(t *testing.T) {
+	// Test matrix
+	sigAlgs := []SignatureAlgorithm{RS256, RS384, RS512, PS256, PS384, PS512, HS256, HS384, HS512, ES256, ES384, ES512, EdDSA}
+
+	serializers := []func(*JSONWebSignature) (string, error){
+		func(obj *JSONWebSignature) (string, error) { return obj.CompactSerialize() },
+		func(obj *JSONWebSignature) (string, error) { return obj.FullSerialize(), nil },
+	}
+
+	corrupters := []func(*JSONWebSignature){
+		func(obj *JSONWebSignature) {
+			// Changes bytes in signature
+			obj.Signatures[0].Signature[10]++
+		},
+		func(obj *JSONWebSignature) {
+			// Set totally invalid signature
+			obj.Signatures[0].Signature = []byte("###")
+		},
+	}
+
+	// Test all different configurations
+	for _, alg := range sigAlgs {
+		signingKey, verificationKey := GenerateSigningTestKey(alg)
+
+		for i, serializer := range serializers {
+			for j, corrupter := range corrupters {
+				err := RoundtripJWS(alg, serializer, corrupter, signingKey, verificationKey, "test_nonce")
+				if err == nil {
+					t.Error("failed to detect corrupt signature", err, alg, i, j)
+				}
+			}
+		}
+	}
+}
+
+func TestSignerWithBrokenRand(t *testing.T) {
+	sigAlgs := []SignatureAlgorithm{RS256, RS384, RS512, PS256, PS384, PS512}
+
+	serializer := func(obj *JSONWebSignature) (string, error) { return obj.CompactSerialize() }
+	corrupter := func(obj *JSONWebSignature) {}
+
+	// Break rand reader
+	readers := []func() io.Reader{
+		// Totally broken
+		func() io.Reader { return bytes.NewReader([]byte{}) },
+		// Not enough bytes
+		func() io.Reader { return io.LimitReader(rand.Reader, 20) },
+	}
+
+	defer resetRandReader()
+
+	for _, alg := range sigAlgs {
+		signingKey, verificationKey := GenerateSigningTestKey(alg)
+		for i, getReader := range readers {
+			RandReader = getReader()
+			err := RoundtripJWS(alg, serializer, corrupter, signingKey, verificationKey, "test_nonce")
+			if err == nil {
+				t.Error("signer should fail if rand is broken", alg, i)
+			}
+		}
+	}
+}
+
+func TestJWSInvalidKey(t *testing.T) {
+	signingKey0, verificationKey0 := GenerateSigningTestKey(RS256)
+	_, verificationKey1 := GenerateSigningTestKey(ES256)
+	_, verificationKey2 := GenerateSigningTestKey(EdDSA)
+
+	signer, err := NewSigner(SigningKey{Algorithm: RS256, Key: signingKey0}, nil)
+	if err != nil {
+		panic(err)
+	}
+
+	input := []byte("Lorem ipsum dolor sit amet")
+	obj, err := signer.Sign(input)
+	if err != nil {
+		panic(err)
+	}
+
+	// Must work with correct key
+	_, err = obj.Verify(verificationKey0)
+	if err != nil {
+		t.Error("error on verify", err)
+	}
+
+	// Must not work with incorrect key
+	_, err = obj.Verify(verificationKey1)
+	if err == nil {
+		t.Error("verification should fail with incorrect key")
+	}
+
+	// Must not work with incorrect key
+	_, err = obj.Verify(verificationKey2)
+	if err == nil {
+		t.Error("verification should fail with incorrect key")
+	}
+
+	// Must not work with invalid key
+	_, err = obj.Verify("")
+	if err == nil {
+		t.Error("verification should fail with incorrect key")
+	}
+}
+
+func TestMultiRecipientJWS(t *testing.T) {
+	sharedKey := []byte{
+		0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15,
+		0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15,
+	}
+	jwkSharedKey := JSONWebKey{
+		KeyID: "123",
+		Key:   sharedKey,
+	}
+
+	signer, err := NewMultiSigner([]SigningKey{
+		{RS256, rsaTestKey},
+		{HS384, sharedKey},
+		{HS512, jwkSharedKey},
+	}, nil)
+	if err != nil {
+		t.Fatal("error creating signer: ", err)
+	}
+
+	input := []byte("Lorem ipsum dolor sit amet")
+	obj, err := signer.Sign(input)
+	if err != nil {
+		t.Fatal("error on sign: ", err)
+	}
+
+	_, err = obj.CompactSerialize()
+	if err == nil {
+		t.Fatal("message with multiple recipient was compact serialized")
+	}
+
+	msg := obj.FullSerialize()
+
+	obj, err = ParseSigned(msg)
+	if err != nil {
+		t.Fatal("error on parse: ", err)
+	}
+
+	i, _, output, err := obj.VerifyMulti(&rsaTestKey.PublicKey)
+	if err != nil {
+		t.Fatal("error on verify: ", err)
+	}
+
+	if i != 0 {
+		t.Fatal("signature index should be 0 for RSA key")
+	}
+
+	if bytes.Compare(output, input) != 0 {
+		t.Fatal("input/output do not match", output, input)
+	}
+
+	i, _, output, err = obj.VerifyMulti(sharedKey)
+	if err != nil {
+		t.Fatal("error on verify: ", err)
+	}
+
+	if i != 1 {
+		t.Fatal("signature index should be 1 for EC key")
+	}
+
+	if bytes.Compare(output, input) != 0 {
+		t.Fatal("input/output do not match", output, input)
+	}
+}
+
+func GenerateSigningTestKey(sigAlg SignatureAlgorithm) (sig, ver interface{}) {
+	switch sigAlg {
+	case EdDSA:
+		sig = ed25519PrivateKey
+		ver = ed25519PublicKey
+	case RS256, RS384, RS512, PS256, PS384, PS512:
+		sig = rsaTestKey
+		ver = &rsaTestKey.PublicKey
+	case HS256, HS384, HS512:
+		sig, _, _ = randomKeyGenerator{size: 16}.genKey()
+		ver = sig
+	case ES256:
+		key, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+		sig = key
+		ver = &key.PublicKey
+	case ES384:
+		key, _ := ecdsa.GenerateKey(elliptic.P384(), rand.Reader)
+		sig = key
+		ver = &key.PublicKey
+	case ES512:
+		key, _ := ecdsa.GenerateKey(elliptic.P521(), rand.Reader)
+		sig = key
+		ver = &key.PublicKey
+	default:
+		panic("Must update test case")
+	}
+
+	return
+}
+
+func TestInvalidSignerAlg(t *testing.T) {
+	_, err := NewSigner(SigningKey{"XYZ", nil}, nil)
+	if err == nil {
+		t.Error("should not accept invalid algorithm")
+	}
+
+	_, err = NewSigner(SigningKey{"XYZ", []byte{}}, nil)
+	if err == nil {
+		t.Error("should not accept invalid algorithm")
+	}
+}
+
+func TestInvalidJWS(t *testing.T) {
+	signer, err := NewSigner(SigningKey{PS256, rsaTestKey}, nil)
+	if err != nil {
+		panic(err)
+	}
+
+	obj, err := signer.Sign([]byte("Lorem ipsum dolor sit amet"))
+	obj.Signatures[0].header = &rawHeader{}
+	obj.Signatures[0].header.set(headerCritical, []string{"TEST"})
+
+	_, err = obj.Verify(&rsaTestKey.PublicKey)
+	if err == nil {
+		t.Error("should not verify message with unknown crit header")
+	}
+
+	// Try without alg header
+	obj.Signatures[0].protected = &rawHeader{}
+	obj.Signatures[0].header = &rawHeader{}
+
+	_, err = obj.Verify(&rsaTestKey.PublicKey)
+	if err == nil {
+		t.Error("should not verify message with missing headers")
+	}
+}
+
+func TestSignerKid(t *testing.T) {
+	kid := "DEADBEEF"
+	payload := []byte("Lorem ipsum dolor sit amet")
+
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Error("problem generating test signing key", err)
+	}
+
+	basejwk := JSONWebKey{Key: key}
+	jsonbar, err := basejwk.MarshalJSON()
+	if err != nil {
+		t.Error("problem marshalling base JWK", err)
+	}
+
+	var jsonmsi map[string]interface{}
+	err = json.Unmarshal(jsonbar, &jsonmsi)
+	if err != nil {
+		t.Error("problem unmarshalling base JWK", err)
+	}
+	jsonmsi["kid"] = kid
+	jsonbar2, err := json.Marshal(jsonmsi)
+	if err != nil {
+		t.Error("problem marshalling kided JWK", err)
+	}
+
+	var jwk JSONWebKey
+	err = jwk.UnmarshalJSON(jsonbar2)
+	if err != nil {
+		t.Error("problem unmarshalling kided JWK", err)
+	}
+
+	signer, err := NewSigner(SigningKey{ES256, &jwk}, nil)
+	if err != nil {
+		t.Error("problem creating signer with *JSONWebKey", err)
+	}
+	signed, err := signer.Sign(payload)
+
+	serialized := signed.FullSerialize()
+
+	parsed, err := ParseSigned(serialized)
+	if err != nil {
+		t.Error("problem parsing signed object", err)
+	}
+
+	if parsed.Signatures[0].Header.KeyID != kid {
+		t.Error("KeyID did not survive trip")
+	}
+
+	signer, err = NewSigner(SigningKey{ES256, jwk}, nil)
+	if err != nil {
+		t.Error("problem creating signer with JSONWebKey", err)
+	}
+}
+
+func TestEmbedJwk(t *testing.T) {
+	var payload = []byte("Lorem ipsum dolor sit amet")
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Error("Failed to generate key")
+	}
+
+	signer, err := NewSigner(SigningKey{ES256, key}, &SignerOptions{EmbedJWK: true})
+	if err != nil {
+		t.Error("Failed to create signer")
+	}
+
+	object, err := signer.Sign(payload)
+	if err != nil {
+		t.Error("Failed to sign payload")
+	}
+
+	object, err = ParseSigned(object.FullSerialize())
+	if err != nil {
+		t.Error("Failed to parse jws")
+	}
+
+	jwk, err := object.Signatures[0].protected.getJWK()
+	if jwk == nil || err != nil {
+		t.Error("JWK isn't set in protected header")
+	}
+
+	// This time, sign and do not embed JWK in message
+	signer, err = NewSigner(SigningKey{ES256, key}, &SignerOptions{EmbedJWK: false})
+
+	object, err = signer.Sign(payload)
+	if err != nil {
+		t.Error("Failed to sign payload")
+	}
+
+	object, err = ParseSigned(object.FullSerialize())
+	if err != nil {
+		t.Error("Failed to parse jws")
+	}
+
+	jwk2, err := object.Signatures[0].protected.getJWK()
+	if err != nil {
+		t.Error("JWK is invalid in protected header")
+	}
+	if jwk2 != nil {
+		t.Error("JWK is set in protected header")
+	}
+}
+
+func TestSignerOptionsEd(t *testing.T) {
+	key, _ := GenerateSigningTestKey(EdDSA)
+	opts := &SignerOptions{
+		EmbedJWK: true,
+	}
+	opts.WithContentType("JWT")
+	opts.WithType("JWT")
+	sig, err := NewSigner(SigningKey{EdDSA, key}, opts)
+	if err != nil {
+		t.Error("Failed to create signer")
+	}
+
+	if !reflect.DeepEqual(*opts, sig.Options()) {
+		t.Error("Signer options do not match")
+	}
+}
+
+func TestSignerOptions(t *testing.T) {
+	key, _ := GenerateSigningTestKey(HS256)
+	opts := &SignerOptions{
+		EmbedJWK: true,
+	}
+	opts.WithContentType("JWT")
+	opts.WithType("JWT")
+	sig, err := NewSigner(SigningKey{HS256, key}, opts)
+	if err != nil {
+		t.Error("Failed to create signer")
+	}
+
+	if !reflect.DeepEqual(*opts, sig.Options()) {
+		t.Error("Signer options do not match")
+	}
+}
+
+// Test that extra headers are generated and parsed in a round trip.
+func TestSignerExtraHeaderInclusion(t *testing.T) {
+	var payload = []byte("Lorem ipsum dolor sit amet")
+
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Error("Failed to generate key")
+	}
+
+	signer, err := NewSigner(SigningKey{ES256, key}, (&SignerOptions{}).WithContentType("foo/bar").WithHeader(HeaderKey("myCustomHeader"), "xyz"))
+	if err != nil {
+		t.Error("Failed to create signer", err)
+	}
+
+	object, err := signer.Sign(payload)
+	if err != nil {
+		t.Error("Failed to sign payload")
+	}
+
+	object, err = ParseSigned(object.FullSerialize())
+	if err != nil {
+		t.Error("Failed to parse jws")
+	}
+
+	correct := map[HeaderKey]interface{}{
+		HeaderContentType:           "foo/bar",
+		HeaderKey("myCustomHeader"): "xyz",
+	}
+
+	if !reflect.DeepEqual(object.Signatures[0].Header.ExtraHeaders, correct) {
+		t.Errorf("Mismatch in extra headers: %#v", object.Signatures[0].Header.ExtraHeaders)
+	}
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/symmetric.go b/vendor/gopkg.in/square/go-jose.v2/symmetric.go
new file mode 100644
index 0000000..264a0fe
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/symmetric.go
@@ -0,0 +1,482 @@
+/*-
+ * Copyright 2014 Square Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package jose
+
+import (
+	"bytes"
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/hmac"
+	"crypto/rand"
+	"crypto/sha256"
+	"crypto/sha512"
+	"crypto/subtle"
+	"errors"
+	"fmt"
+	"hash"
+	"io"
+
+	"golang.org/x/crypto/pbkdf2"
+	"gopkg.in/square/go-jose.v2/cipher"
+)
+
+// Random reader (stubbed out in tests)
+var RandReader = rand.Reader
+
+const (
+	// RFC7518 recommends a minimum of 1,000 iterations:
+	// https://tools.ietf.org/html/rfc7518#section-4.8.1.2
+	// NIST recommends a minimum of 10,000:
+	// https://pages.nist.gov/800-63-3/sp800-63b.html
+	// 1Password uses 100,000:
+	// https://support.1password.com/pbkdf2/
+	defaultP2C = 100000
+	// Default salt size: 128 bits
+	defaultP2SSize = 16
+)
+
+// Dummy key cipher for shared symmetric key mode
+type symmetricKeyCipher struct {
+	key []byte // Pre-shared content-encryption key
+	p2c int    // PBES2 Count
+	p2s []byte // PBES2 Salt Input
+}
+
+// Signer/verifier for MAC modes
+type symmetricMac struct {
+	key []byte
+}
+
+// Input/output from an AEAD operation
+type aeadParts struct {
+	iv, ciphertext, tag []byte
+}
+
+// A content cipher based on an AEAD construction
+type aeadContentCipher struct {
+	keyBytes     int
+	authtagBytes int
+	getAead      func(key []byte) (cipher.AEAD, error)
+}
+
+// Random key generator
+type randomKeyGenerator struct {
+	size int
+}
+
+// Static key generator
+type staticKeyGenerator struct {
+	key []byte
+}
+
+// Create a new content cipher based on AES-GCM
+func newAESGCM(keySize int) contentCipher {
+	return &aeadContentCipher{
+		keyBytes:     keySize,
+		authtagBytes: 16,
+		getAead: func(key []byte) (cipher.AEAD, error) {
+			aes, err := aes.NewCipher(key)
+			if err != nil {
+				return nil, err
+			}
+
+			return cipher.NewGCM(aes)
+		},
+	}
+}
+
+// Create a new content cipher based on AES-CBC+HMAC
+func newAESCBC(keySize int) contentCipher {
+	return &aeadContentCipher{
+		keyBytes:     keySize * 2,
+		authtagBytes: keySize,
+		getAead: func(key []byte) (cipher.AEAD, error) {
+			return josecipher.NewCBCHMAC(key, aes.NewCipher)
+		},
+	}
+}
+
+// Get an AEAD cipher object for the given content encryption algorithm
+func getContentCipher(alg ContentEncryption) contentCipher {
+	switch alg {
+	case A128GCM:
+		return newAESGCM(16)
+	case A192GCM:
+		return newAESGCM(24)
+	case A256GCM:
+		return newAESGCM(32)
+	case A128CBC_HS256:
+		return newAESCBC(16)
+	case A192CBC_HS384:
+		return newAESCBC(24)
+	case A256CBC_HS512:
+		return newAESCBC(32)
+	default:
+		return nil
+	}
+}
+
+// getPbkdf2Params returns the key length and hash function used in
+// pbkdf2.Key.
+func getPbkdf2Params(alg KeyAlgorithm) (int, func() hash.Hash) {
+	switch alg {
+	case PBES2_HS256_A128KW:
+		return 16, sha256.New
+	case PBES2_HS384_A192KW:
+		return 24, sha512.New384
+	case PBES2_HS512_A256KW:
+		return 32, sha512.New
+	default:
+		panic("invalid algorithm")
+	}
+}
+
+// getRandomSalt generates a new salt of the given size.
+func getRandomSalt(size int) ([]byte, error) {
+	salt := make([]byte, size)
+	_, err := io.ReadFull(RandReader, salt)
+	if err != nil {
+		return nil, err
+	}
+
+	return salt, nil
+}
+
+// newSymmetricRecipient creates a JWE encrypter based on AES-GCM key wrap.
+func newSymmetricRecipient(keyAlg KeyAlgorithm, key []byte) (recipientKeyInfo, error) {
+	switch keyAlg {
+	case DIRECT, A128GCMKW, A192GCMKW, A256GCMKW, A128KW, A192KW, A256KW:
+	case PBES2_HS256_A128KW, PBES2_HS384_A192KW, PBES2_HS512_A256KW:
+	default:
+		return recipientKeyInfo{}, ErrUnsupportedAlgorithm
+	}
+
+	return recipientKeyInfo{
+		keyAlg: keyAlg,
+		keyEncrypter: &symmetricKeyCipher{
+			key: key,
+		},
+	}, nil
+}
+
+// newSymmetricSigner creates a recipientSigInfo based on the given key.
+func newSymmetricSigner(sigAlg SignatureAlgorithm, key []byte) (recipientSigInfo, error) {
+	// Verify that key management algorithm is supported by this encrypter
+	switch sigAlg {
+	case HS256, HS384, HS512:
+	default:
+		return recipientSigInfo{}, ErrUnsupportedAlgorithm
+	}
+
+	return recipientSigInfo{
+		sigAlg: sigAlg,
+		signer: &symmetricMac{
+			key: key,
+		},
+	}, nil
+}
+
+// Generate a random key for the given content cipher
+func (ctx randomKeyGenerator) genKey() ([]byte, rawHeader, error) {
+	key := make([]byte, ctx.size)
+	_, err := io.ReadFull(RandReader, key)
+	if err != nil {
+		return nil, rawHeader{}, err
+	}
+
+	return key, rawHeader{}, nil
+}
+
+// Key size for random generator
+func (ctx randomKeyGenerator) keySize() int {
+	return ctx.size
+}
+
+// Generate a static key (for direct mode)
+func (ctx staticKeyGenerator) genKey() ([]byte, rawHeader, error) {
+	cek := make([]byte, len(ctx.key))
+	copy(cek, ctx.key)
+	return cek, rawHeader{}, nil
+}
+
+// Key size for static generator
+func (ctx staticKeyGenerator) keySize() int {
+	return len(ctx.key)
+}
+
+// Get key size for this cipher
+func (ctx aeadContentCipher) keySize() int {
+	return ctx.keyBytes
+}
+
+// Encrypt some data
+func (ctx aeadContentCipher) encrypt(key, aad, pt []byte) (*aeadParts, error) {
+	// Get a new AEAD instance
+	aead, err := ctx.getAead(key)
+	if err != nil {
+		return nil, err
+	}
+
+	// Initialize a new nonce
+	iv := make([]byte, aead.NonceSize())
+	_, err = io.ReadFull(RandReader, iv)
+	if err != nil {
+		return nil, err
+	}
+
+	ciphertextAndTag := aead.Seal(nil, iv, pt, aad)
+	offset := len(ciphertextAndTag) - ctx.authtagBytes
+
+	return &aeadParts{
+		iv:         iv,
+		ciphertext: ciphertextAndTag[:offset],
+		tag:        ciphertextAndTag[offset:],
+	}, nil
+}
+
+// Decrypt some data
+func (ctx aeadContentCipher) decrypt(key, aad []byte, parts *aeadParts) ([]byte, error) {
+	aead, err := ctx.getAead(key)
+	if err != nil {
+		return nil, err
+	}
+
+	if len(parts.iv) != aead.NonceSize() || len(parts.tag) < ctx.authtagBytes {
+		return nil, ErrCryptoFailure
+	}
+
+	return aead.Open(nil, parts.iv, append(parts.ciphertext, parts.tag...), aad)
+}
+
+// Encrypt the content encryption key.
+func (ctx *symmetricKeyCipher) encryptKey(cek []byte, alg KeyAlgorithm) (recipientInfo, error) {
+	switch alg {
+	case DIRECT:
+		return recipientInfo{
+			header: &rawHeader{},
+		}, nil
+	case A128GCMKW, A192GCMKW, A256GCMKW:
+		aead := newAESGCM(len(ctx.key))
+
+		parts, err := aead.encrypt(ctx.key, []byte{}, cek)
+		if err != nil {
+			return recipientInfo{}, err
+		}
+
+		header := &rawHeader{}
+		header.set(headerIV, newBuffer(parts.iv))
+		header.set(headerTag, newBuffer(parts.tag))
+
+		return recipientInfo{
+			header:       header,
+			encryptedKey: parts.ciphertext,
+		}, nil
+	case A128KW, A192KW, A256KW:
+		block, err := aes.NewCipher(ctx.key)
+		if err != nil {
+			return recipientInfo{}, err
+		}
+
+		jek, err := josecipher.KeyWrap(block, cek)
+		if err != nil {
+			return recipientInfo{}, err
+		}
+
+		return recipientInfo{
+			encryptedKey: jek,
+			header:       &rawHeader{},
+		}, nil
+	case PBES2_HS256_A128KW, PBES2_HS384_A192KW, PBES2_HS512_A256KW:
+		if len(ctx.p2s) == 0 {
+			salt, err := getRandomSalt(defaultP2SSize)
+			if err != nil {
+				return recipientInfo{}, err
+			}
+			ctx.p2s = salt
+		}
+
+		if ctx.p2c <= 0 {
+			ctx.p2c = defaultP2C
+		}
+
+		// salt is UTF8(Alg) || 0x00 || Salt Input
+		salt := bytes.Join([][]byte{[]byte(alg), ctx.p2s}, []byte{0x00})
+
+		// derive key
+		keyLen, h := getPbkdf2Params(alg)
+		key := pbkdf2.Key(ctx.key, salt, ctx.p2c, keyLen, h)
+
+		// use AES cipher with derived key
+		block, err := aes.NewCipher(key)
+		if err != nil {
+			return recipientInfo{}, err
+		}
+
+		jek, err := josecipher.KeyWrap(block, cek)
+		if err != nil {
+			return recipientInfo{}, err
+		}
+
+		header := &rawHeader{}
+		header.set(headerP2C, ctx.p2c)
+		header.set(headerP2S, newBuffer(ctx.p2s))
+
+		return recipientInfo{
+			encryptedKey: jek,
+			header:       header,
+		}, nil
+	}
+
+	return recipientInfo{}, ErrUnsupportedAlgorithm
+}
+
+// Decrypt the content encryption key.
+func (ctx *symmetricKeyCipher) decryptKey(headers rawHeader, recipient *recipientInfo, generator keyGenerator) ([]byte, error) {
+	switch headers.getAlgorithm() {
+	case DIRECT:
+		cek := make([]byte, len(ctx.key))
+		copy(cek, ctx.key)
+		return cek, nil
+	case A128GCMKW, A192GCMKW, A256GCMKW:
+		aead := newAESGCM(len(ctx.key))
+
+		iv, err := headers.getIV()
+		if err != nil {
+			return nil, fmt.Errorf("square/go-jose: invalid IV: %v", err)
+		}
+		tag, err := headers.getTag()
+		if err != nil {
+			return nil, fmt.Errorf("square/go-jose: invalid tag: %v", err)
+		}
+
+		parts := &aeadParts{
+			iv:         iv.bytes(),
+			ciphertext: recipient.encryptedKey,
+			tag:        tag.bytes(),
+		}
+
+		cek, err := aead.decrypt(ctx.key, []byte{}, parts)
+		if err != nil {
+			return nil, err
+		}
+
+		return cek, nil
+	case A128KW, A192KW, A256KW:
+		block, err := aes.NewCipher(ctx.key)
+		if err != nil {
+			return nil, err
+		}
+
+		cek, err := josecipher.KeyUnwrap(block, recipient.encryptedKey)
+		if err != nil {
+			return nil, err
+		}
+		return cek, nil
+	case PBES2_HS256_A128KW, PBES2_HS384_A192KW, PBES2_HS512_A256KW:
+		p2s, err := headers.getP2S()
+		if err != nil {
+			return nil, fmt.Errorf("square/go-jose: invalid P2S: %v", err)
+		}
+		if p2s == nil || len(p2s.data) == 0 {
+			return nil, fmt.Errorf("square/go-jose: invalid P2S: must be present")
+		}
+
+		p2c, err := headers.getP2C()
+		if err != nil {
+			return nil, fmt.Errorf("square/go-jose: invalid P2C: %v", err)
+		}
+		if p2c <= 0 {
+			return nil, fmt.Errorf("square/go-jose: invalid P2C: must be a positive integer")
+		}
+
+		// salt is UTF8(Alg) || 0x00 || Salt Input
+		alg := headers.getAlgorithm()
+		salt := bytes.Join([][]byte{[]byte(alg), p2s.bytes()}, []byte{0x00})
+
+		// derive key
+		keyLen, h := getPbkdf2Params(alg)
+		key := pbkdf2.Key(ctx.key, salt, p2c, keyLen, h)
+
+		// use AES cipher with derived key
+		block, err := aes.NewCipher(key)
+		if err != nil {
+			return nil, err
+		}
+
+		cek, err := josecipher.KeyUnwrap(block, recipient.encryptedKey)
+		if err != nil {
+			return nil, err
+		}
+		return cek, nil
+	}
+
+	return nil, ErrUnsupportedAlgorithm
+}
+
+// Sign the given payload
+func (ctx symmetricMac) signPayload(payload []byte, alg SignatureAlgorithm) (Signature, error) {
+	mac, err := ctx.hmac(payload, alg)
+	if err != nil {
+		return Signature{}, errors.New("square/go-jose: failed to compute hmac")
+	}
+
+	return Signature{
+		Signature: mac,
+		protected: &rawHeader{},
+	}, nil
+}
+
+// Verify the given payload
+func (ctx symmetricMac) verifyPayload(payload []byte, mac []byte, alg SignatureAlgorithm) error {
+	expected, err := ctx.hmac(payload, alg)
+	if err != nil {
+		return errors.New("square/go-jose: failed to compute hmac")
+	}
+
+	if len(mac) != len(expected) {
+		return errors.New("square/go-jose: invalid hmac")
+	}
+
+	match := subtle.ConstantTimeCompare(mac, expected)
+	if match != 1 {
+		return errors.New("square/go-jose: invalid hmac")
+	}
+
+	return nil
+}
+
+// Compute the HMAC based on the given alg value
+func (ctx symmetricMac) hmac(payload []byte, alg SignatureAlgorithm) ([]byte, error) {
+	var hash func() hash.Hash
+
+	switch alg {
+	case HS256:
+		hash = sha256.New
+	case HS384:
+		hash = sha512.New384
+	case HS512:
+		hash = sha512.New
+	default:
+		return nil, ErrUnsupportedAlgorithm
+	}
+
+	hmac := hmac.New(hash, ctx.key)
+
+	// According to documentation, Write() on hash never fails
+	_, _ = hmac.Write(payload)
+	return hmac.Sum(nil), nil
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/symmetric_test.go b/vendor/gopkg.in/square/go-jose.v2/symmetric_test.go
new file mode 100644
index 0000000..c4aa116
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/symmetric_test.go
@@ -0,0 +1,196 @@
+/*-
+ * Copyright 2014 Square Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package jose
+
+import (
+	"bytes"
+	"crypto/cipher"
+	"crypto/rand"
+	"crypto/sha256"
+	"io"
+	"testing"
+
+	"golang.org/x/crypto/pbkdf2"
+)
+
+func TestInvalidSymmetricAlgorithms(t *testing.T) {
+	_, err := newSymmetricRecipient("XYZ", []byte{})
+	if err != ErrUnsupportedAlgorithm {
+		t.Error("should not accept invalid algorithm")
+	}
+
+	enc := &symmetricKeyCipher{}
+	_, err = enc.encryptKey([]byte{}, "XYZ")
+	if err != ErrUnsupportedAlgorithm {
+		t.Error("should not accept invalid algorithm")
+	}
+}
+
+func TestAeadErrors(t *testing.T) {
+	aead := &aeadContentCipher{
+		keyBytes:     16,
+		authtagBytes: 16,
+		getAead: func(key []byte) (cipher.AEAD, error) {
+			return nil, ErrCryptoFailure
+		},
+	}
+
+	parts, err := aead.encrypt([]byte{}, []byte{}, []byte{})
+	if err != ErrCryptoFailure {
+		t.Error("should handle aead failure")
+	}
+
+	_, err = aead.decrypt([]byte{}, []byte{}, parts)
+	if err != ErrCryptoFailure {
+		t.Error("should handle aead failure")
+	}
+}
+
+func TestInvalidKey(t *testing.T) {
+	gcm := newAESGCM(16).(*aeadContentCipher)
+	_, err := gcm.getAead([]byte{})
+	if err == nil {
+		t.Error("should not accept invalid key")
+	}
+}
+
+func TestStaticKeyGen(t *testing.T) {
+	key := make([]byte, 32)
+	io.ReadFull(rand.Reader, key)
+
+	gen := &staticKeyGenerator{key: key}
+	if gen.keySize() != len(key) {
+		t.Error("static key generator reports incorrect size")
+	}
+
+	generated, _, err := gen.genKey()
+	if err != nil {
+		t.Error("static key generator should always succeed", err)
+	}
+	if !bytes.Equal(generated, key) {
+		t.Error("static key generator returns different data")
+	}
+}
+
+func TestAeadInvalidInput(t *testing.T) {
+	sample := []byte("1234567890123456")
+	tt := []aeadParts{
+		{},
+		{iv: sample, tag: sample},
+	}
+	for _, tc := range tt {
+		aead := newAESGCM(16).(*aeadContentCipher)
+		_, err := aead.decrypt(sample, []byte{}, &tc)
+		if err != ErrCryptoFailure {
+			t.Error("should handle aead failure")
+		}
+	}
+}
+
+func TestVectorsAESGCM(t *testing.T) {
+	// Source: http://tools.ietf.org/html/draft-ietf-jose-json-web-encryption-29#appendix-A.1
+	plaintext := []byte{
+		84, 104, 101, 32, 116, 114, 117, 101, 32, 115, 105, 103, 110, 32,
+		111, 102, 32, 105, 110, 116, 101, 108, 108, 105, 103, 101, 110, 99,
+		101, 32, 105, 115, 32, 110, 111, 116, 32, 107, 110, 111, 119, 108,
+		101, 100, 103, 101, 32, 98, 117, 116, 32, 105, 109, 97, 103, 105,
+		110, 97, 116, 105, 111, 110, 46}
+
+	aad := []byte{
+		101, 121, 74, 104, 98, 71, 99, 105, 79, 105, 74, 83, 85, 48, 69,
+		116, 84, 48, 70, 70, 85, 67, 73, 115, 73, 109, 86, 117, 89, 121, 73,
+		54, 73, 107, 69, 121, 78, 84, 90, 72, 81, 48, 48, 105, 102, 81}
+
+	expectedCiphertext := []byte{
+		229, 236, 166, 241, 53, 191, 115, 196, 174, 43, 73, 109, 39, 122,
+		233, 96, 140, 206, 120, 52, 51, 237, 48, 11, 190, 219, 186, 80, 111,
+		104, 50, 142, 47, 167, 59, 61, 181, 127, 196, 21, 40, 82, 242, 32,
+		123, 143, 168, 226, 73, 216, 176, 144, 138, 247, 106, 60, 16, 205,
+		160, 109, 64, 63, 192}
+
+	expectedAuthtag := []byte{
+		92, 80, 104, 49, 133, 25, 161, 215, 173, 101, 219, 211, 136, 91, 210, 145}
+
+	// Mock random reader
+	RandReader = bytes.NewReader([]byte{
+		177, 161, 244, 128, 84, 143, 225, 115, 63, 180, 3, 255, 107, 154,
+		212, 246, 138, 7, 110, 91, 112, 46, 34, 105, 47, 130, 203, 46, 122,
+		234, 64, 252, 227, 197, 117, 252, 2, 219, 233, 68, 180, 225, 77, 219})
+	defer resetRandReader()
+
+	enc := newAESGCM(32)
+	key, _, _ := randomKeyGenerator{size: 32}.genKey()
+	out, err := enc.encrypt(key, aad, plaintext)
+	if err != nil {
+		t.Error("Unable to encrypt:", err)
+		return
+	}
+
+	if bytes.Compare(out.ciphertext, expectedCiphertext) != 0 {
+		t.Error("Ciphertext did not match")
+	}
+	if bytes.Compare(out.tag, expectedAuthtag) != 0 {
+		t.Error("Auth tag did not match")
+	}
+}
+
+func TestVectorPBES2_HS256A_128KW(t *testing.T) {
+	cipher := &symmetricKeyCipher{
+		key: []byte("Thus from my lips, by yours, my sin is purged."),
+		p2c: 4096,
+		p2s: []byte{
+			217, 96, 147, 112, 150, 117, 70,
+			247, 127, 8, 155, 137, 174, 42, 80, 215,
+		},
+	}
+
+	cek := []byte{
+		111, 27, 25, 52, 66, 29, 20, 78, 92, 176, 56, 240, 65, 208, 82, 112,
+		161, 131, 36, 55, 202, 236, 185, 172, 129, 23, 153, 194, 195, 48,
+		253, 182,
+	}
+
+	// PBES2-HS256+A128KW || 0x00 || p2s
+	salt := []byte{
+		80, 66, 69, 83, 50, 45, 72, 83, 50, 53, 54, 43, 65, 49, 50, 56, 75,
+		87, 0, 217, 96, 147, 112, 150, 117, 70, 247, 127, 8, 155, 137, 174,
+		42, 80, 215,
+	}
+
+	expectedDerivedKey := []byte{
+		110, 171, 169, 92, 129, 92, 109, 117, 233, 242, 116, 233, 170, 14,
+		24, 75}
+
+	expectedEncryptedKey := []byte{
+		78, 186, 151, 59, 11, 141, 81, 240, 213, 245, 83, 211, 53, 188, 134,
+		188, 66, 125, 36, 200, 222, 124, 5, 103, 249, 52, 117, 184, 140, 81,
+		246, 158, 161, 177, 20, 33, 245, 57, 59, 4}
+
+	derivedKey := pbkdf2.Key(cipher.key, salt, cipher.p2c, 16, sha256.New)
+	if bytes.Compare(derivedKey, expectedDerivedKey) != 0 {
+		t.Error("Derived key did not match")
+	}
+
+	encryptedKey, err := cipher.encryptKey(cek, PBES2_HS256_A128KW)
+	if err != nil {
+		t.Fatal("Unable to encrypt:", err)
+	}
+
+	if bytes.Compare(encryptedKey.encryptedKey, expectedEncryptedKey) != 0 {
+		t.Error("Encrypted key did not match")
+	}
+}
diff --git a/vendor/gopkg.in/square/go-jose.v2/utils_test.go b/vendor/gopkg.in/square/go-jose.v2/utils_test.go
new file mode 100644
index 0000000..434636b
--- /dev/null
+++ b/vendor/gopkg.in/square/go-jose.v2/utils_test.go
@@ -0,0 +1,80 @@
+/*-
+ * Copyright 2014 Square Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package jose
+
+import (
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/hex"
+	"math/big"
+	"regexp"
+)
+
+// Reset random reader to original value
+func resetRandReader() {
+	RandReader = rand.Reader
+}
+
+// Build big int from hex-encoded string. Strips whitespace (for testing).
+func fromHexInt(base16 string) *big.Int {
+	re := regexp.MustCompile(`\s+`)
+	val, ok := new(big.Int).SetString(re.ReplaceAllString(base16, ""), 16)
+	if !ok {
+		panic("Invalid test data")
+	}
+	return val
+}
+
+// Build big int from base64-encoded string. Strips whitespace (for testing).
+func fromBase64Int(encoded string) *big.Int {
+	re := regexp.MustCompile(`\s+`)
+	val, err := base64.RawURLEncoding.DecodeString(re.ReplaceAllString(encoded, ""))
+	if err != nil {
+		panic("Invalid test data: " + err.Error())
+	}
+	return new(big.Int).SetBytes(val)
+}
+
+// Decode hex-encoded string into byte array. Strips whitespace (for testing).
+func fromHexBytes(base16 string) []byte {
+	re := regexp.MustCompile(`\s+`)
+	val, err := hex.DecodeString(re.ReplaceAllString(base16, ""))
+	if err != nil {
+		panic("Invalid test data")
+	}
+	return val
+}
+
+// Decode base64-encoded string into byte array. Strips whitespace (for testing).
+func fromBase64Bytes(b64 string) []byte {
+	re := regexp.MustCompile(`\s+`)
+	val, err := base64.StdEncoding.DecodeString(re.ReplaceAllString(b64, ""))
+	if err != nil {
+		panic("Invalid test data")
+	}
+	return val
+}
+
+// Decode base64-urlencoded string into byte array. Strips whitespace (for testing).
+func fromBase64URLBytes(b64 string) []byte {
+	re := regexp.MustCompile(`\s+`)
+	val, err := base64.RawURLEncoding.DecodeString(re.ReplaceAllString(b64, ""))
+	if err != nil {
+		panic("Invalid test data")
+	}
+	return val
+}