upgrade to bcrypt 0.2.4 and move to bcrypt async apis, this keeps us from blocking the web server thread and leverages the threading support in the bcrypt library for better compute throughput and responsiveness.

(load gen) add_email might occur on a device that hasn't been used yet, in which case we need to authenticate

test harness now tries to shut down gracefully.  this allows cleanup to occur (i.e. of database when running in a test mode)

output human readable summary information of what kind of load will be applied when the load gen starts with a fixed target number of active users.

close #200

close #195.

Change the csrf response type to 'html'.

This makes sure that the non-XML response is parsed correctly and jQuery does not throw an error.

Fixing a problem where new email addresses added to an existing account would not get synced correctly directly after confirmation.

Conflicts:
	browserid/static/js/browserid.js

(load gen) handle case where all users are 'locked' (in use by other activities), fix bug where cb was doubly invoked

remove redundant check that an authenticated user may add a key.  this is performed up at the wsapi level now, so let's save a database query

move wsapi_client.js to libs/ where it can be shared by other code needing a programmatic client to the browserid WSAPI

Ensure req.body exists before trying to use it.