initial implementation of request forwarding, cookies set from dbwriter are still not being properly passed through - issue #460

add the dbwriter process.   it's not yet hooked up, but starts up and runs, and included in health check.

reorganize browserid process - break out view serving and wsapi handling.  preparation for dbwriter split.  issue #460

implement graceful process shutdown, and clear logging as to the reason why processes are terminating.  include winston handling of uncaught exceptions.  this all goes into a library that all of our processes use.  closes #529

in production (dev/beta/prod) use a more conventional logging format that includes timestamps.  closes #234

implement graceful process shutdown, and clear logging as to the reason why processes are terminating.  include winston handling of uncaught exceptions.  this all goes into a library that all of our processes use.  closes #529

in production (dev/beta/prod) use a more conventional logging format that includes timestamps.  closes #234

fix CSRF checking logic, once we identify a single problem with the CSRF token, don't fall through to further checks

WSAPI CHANGES: All server responses are now objects, makes some funky browsers happy and prevents certain attacks.  closes #217 closes #325

  * /wsapi/have_email now returns { email_known: <boolean> }
  * /wsapi/stage_user now returns { success: <boolean> }
  * /wsapi/user_creation_status now returns { status: <string> }
  * /wsapi/complete_user_creation now returns { status: <boolean> }
  * /wsapi/stage_email now returns { success: <boolean> }
  * /wsapi/email_addition_status now returns { success: <boolean> }
  * /wsapi/complete_email_addition now returns { success: <boolean> }
  * /wsapi/authenticate_user now returns { success: <boolean> }
  * /wsapi/remove_email now returns { success: <boolean> }
  * /wsapi/account_cancel now returns { success: <boolean> }
  * /wsapi/logout now returns { success: <boolean> }

Finally, introduced middleware to ensure that resp.json() is not called with anything other than an object.

ensure users must authenticate every week (issue #309).  Also, move all magic numbers out of implementation and into the configuration abstraction.

This gives us end to end flow!  BOOOYA!

prove.ejs -> verifyemail.ejs
verify.ejs -> verifyuser.ejs

urls are the same - verifyemail, verifyuser

now that jwcrypto is a node module, we shall change the way that we include it (ie jwcrypto/vep rather than by relative path)