move wsapi_client.js to libs/ where it can be shared by other code needing a programmatic client to the browserid WSAPI

add a 'fake verification' mechanism that can be enabled for testing via an environment variable, and will return secrets via the wsapi.  add plenty of checks to ensure this never makes it into production.

sketch a general WSAPI client library with support for multiple simultaneous connections, port include_only onto it

added CSRF protection and started moving actions that need it to POST, which automatically inherits CSRF protection. Not complete yet