* Further use of the testExpectGetFailure, testExpectGetSuccess, testRelativeURLNotAllowed and testMustBeAbsolutePath

Disallow "/" for:
* siteLogo
* termsOfService
* privacyPolicy

The current check to ensure that only absolute paths are accepted
fails to take into account scheme-relative URLs like "//foo.com".

These URLs end up in fixupURL and get the origin prepended to them
to something like "https://origin.example.com//foo.com", which is
invalid but still follows our same-origin restrictions.

So the solution is to require that the character after the leading
slash be anything but a slash.

3 jshintrc files, because of different environments:

1. node
2. browser
3. browser tests

* /forgot
* /verify_email_address
* /add_email_address
* /reset_password
* /confirm

symlink no worky on Windows, so make a copy
at postinstall instead

* Unit tests now check the displayed order of the addresses against the data model's sorted order.

fixes #2457

- dont escape siteName, we escape it right when we get it
- no longer need site views symlink
- remove ejs lib from /test

_.template uses new Function, which means evalling code
evalling code is bad. so now we don't do it.

manage acct page uses a template, but has no
need for EJS to parse it, since it's plain HTML.

this returns compiled site templates, similar to the dialog templates,
which are needed by the test suite to test the site works!

The list of templates gets pushed onto a single file, with the EJS pre-compiled
into functions. Then, in the Renderer, the functions only need to be invoked,
meaning we no longer need the EJS client lib, and don't eval code.

fixes #2427

If there is no saved site info in localStorage, redirect to the management page after verification is complete.

* All screens are now scrollable depending on their height.
* Variable renaming for clarity.

onready is in a weird state of limbo: we know we're going to deprecate it, we
know what we're going to replace it with, and we know we want to discourage its
use for the moment, but we haven't actually planned, implemented, or announced
its replacement.

We haven't announced its deprecation, either.

Adding two small comments in-code to ensure that we don't inadvertantly remove
this without giving RPs proper notice. After all, if onready stops firing, we
seriously break sites that rely on it.

See GH-2017 for more info.

* to dom-jquery, add closest and insertAfter

- unix symlinks are incompatible with Windows
- postinstall now generates keys, and sets up files

fixes #2263

if id.watch() is called in the head, and document.body
doesn't exist yet, a listener is added for domready, and then
the iframe is created.

Fix the password being hidden if the user tabbed into the email field without typing any key besides tab.

Add the following new events to the KPI event stream:
* user.reset_password_staged
* user.reset_password_confirmed
* user.reverify_email_staged
* user.reverify_email_confirmed

There was a spelling error in the user.user_confirmed, it was previously user.user_confrimed.