improved error handling for /auth endpoint

[bnfinet]

as a follow up to PR #46

• might be time to have renderError routine similar to renderIndex in handlers.go
• look for error_uri callback parameter in addition to error_description and report to the end user's browser
• same for the value of error

[bnfinet]

and return 403 when a user has cleared the IdP but they are not valid for VP (not on whitelist, not in domain, etc)