verifier now responds to requests to / and to /verify.  in production we're routing verify calls to the latter (via nginx).  closes #67

simplify verifier a bit to make it simpler to use either off the same domain as browserid.org OR on its own domain.

add /code_update handlers to all servers to allow unpriviled users with localhost access on the machine to shut them down with an http request (for code update)

implement localstorage caching of ids and pubkeys, stub out assertion generation crypto and use it from client code

migrate to the connect framework for node.js, specifically this provides session management middleware