* Removing StealJS from the build system, compressing the files manually.
* Removing the stealjs dependency from the unit tests.
* Removing funcunit, dialog/scripts, steal, jsmvc
* Updating the unit tests to use the current version of QUnit.
* Updated a lot of test to asyncTest and removed the stop().

issue #634

close #625

rework the authenticate_user api - now it is read only (will run on webheads) and will call over to dbwriter if and when bcrypt password update is in play.  This shifts the majority of authentication compute cost over to webheads from secure webheads - closes #560

* Remove the state machine from the dialog module.
* Add unit tests for the state machine.
* The state machine has the ability to cancel any stage and go to the previous stage.
* All cancel_* messages are now "cancel_stage" for uniformity.
* Update all unit tests to create then start their modules.

* StealJS is still the script loader.
* Putting OpenAjax.hub into lib.
* Adding a Class/SubClass mechanism.
* Converting all controllers to be Subclassed from Modules.PageModule.
* All Modules are registered first, then created/started on demand.\

implement update_password api - prerequsite for frontend code of issue #114 and for moving the bulk of bcrypt compute work over to webheads which is issue #560

another unit test fix for json database - if database cannot be removed, it's not an error.  it can mean it was never created

for the JSON database 'engine', don't write database at close.  This was causing browserid to stomp changes made be dbwriter during tests where server restart occurs (like bcrypt password update test) - *really* closes issue #557

remove extra newlines from console output when running tests.  easier to read and compare output now.

* Make the WinMock a function so that we can easily reset its state after every test.
* Do the winMock init in the startup function to reduce cruft.
* Close the channel after every test, causing a channel reset.

update mocked network responses in frontend unit tests - add missing request line, include domain_key_creation_time in session_context response

include vepbundle in qunit tests - fixes several broken frontend tests - fixes regressions introduced while working on issue #606

fix IE8 specific includes, moved from /js to /lib in 90ba4e7f closes #615

re-apply "bundle vepbundle along with everything else.  use the power of symlinks.  closes #606" (post-update hooks now npm install first, and compress resources second)

some rpm build fixes

This reverts commit 62978433.

store public key on disk as a certificate which has embedded creation time.  use that as the value returned in /wsapi/session_context as domain_key_creation_time - now you can update keys at any time and outstanding client certs are expired automatically - closes #599

update jwcrypto, now issued_at is part of certificate.  in frontend code compare server time, issued_at, and domain_key_creation_time to determine if a cert has expired.  (previously, clock skew could cause certs to be regened every single time.  hawt.) issue #599

frontend checks to invalidate keys that were issued before the last time the domain key was updated - #599

(loadgen) implement assertion generation in loadgen client, hook up signup and signin flows - issue #504

* Added forgotpassword_controller, forgotpassword.ejs, and forgotpassword_controller_unit_test.
* Updated the authenticate controller/template/tests to remove the forgotpassword stuff.
* Added several more tests to the authenticate suite.
* Hooking up the expanded forgot password flow for "required email".
* Unifying the styles between the "required email" screen and the normal flow.

issue #608

* Creating addemail_controller, addemail_controller_unit_tests, and addemail.ejs.
* Shrink down pickemail_controller, and pickemail.ejs.
* Update a lot of the pickemail_controller unit tests to be more complete.
* Account consolidation is again possible.

close #607
close #612