* require only user:email oauth scope when signing up * if user wants to set bounties on repos, request additional oauth scopes * do not store github access tokens on server side and use client-side localStorage instead Fixes: #35 Fixes: #40