* Update the "stage_user" and "stage_email" to take a password where appropriate.
* Remove pass from calls to "complete_user_creation" and "complete_email_addition"
* Update database drivers to set the account password where appropriate.
* Update unit tests.

fixed check for site parameter, it should be an origin not a domain, and fixed all tests accordingly. Was careful not to screw up the verifier tests that are testing for old parameters to the verifier.

API changes for public terminals/shared computers, and update all tests
to post data using JSON rather than form encoding, as the front end now does.

update wsapi_client to return errors in the standard node convention.  update all clients.  fix several areas in loadgen where we were not properly handling errors.  improve informational output of loadgen failures.  closes #838 - helps with issue #784 - closes #785

reorganize browserid process - break out view serving and wsapi handling.  preparation for dbwriter split.  issue #460

server side changes for issue #329 - /csrf call is now /session_context and returns current server time - to be used to allow clients with broken clocks to generate valid assertions

WSAPI CHANGES in preparation for new UX flows, specifically where you provide a password AFTER verifying emails.

  * stage_user no longer takes a password
  * after calling stage_user, you can poll status with user_creation_status
  * instead of 'prove_email_ownership', you call 'complete_user_creation' and provide a password
  * add_email is now 'stage_email'
  * after calling stage_email, you can poll status with email_addition_status
  * instead of 'prove_email_ownership', you call 'complete_email_addition' and provide a password
  * stage_* and complete_* calls are POST
  * *_status calls succeed continuously (not only once)

For tests, instrument `email.js` so that one may register an interceptor
function which will be invoked rather than attempting to send email.

closes #88.