break outbound email interception into a separate library - more capturing of commonality for browserid tests

working stub for registration status.  incidentially, at present, this is the fruit of refactoring, a minimal test stub that gets a browserid server up and running and ready for testing

first attempt at standalone tests for the browserid server - startup, simple HTTP transactions, shutdown

added email config to make testing email easier - be careful on production. Fixed sub-bug in db.js, callback not returned.

a re-thinking of forgotten password flow and partial implementation (for the purposes of initial launch, forgotton password flow is a re-verification of email, and it will require re-verification of other emails as well)

return the string encoded JWT to the client, don't wrap it in a magic object as it might guide developers into trusting something that is untrustworthy.  closes #33

fix content-type of host-meta, which ultimately repairs the local testing setup (substitution is not performed on stuff that isn't text)