in production (dev/beta/prod) use a more conventional logging format that includes timestamps.  closes #234

fix CSRF checking logic, once we identify a single problem with the CSRF token, don't fall through to further checks

WSAPI CHANGES: All server responses are now objects, makes some funky browsers happy and prevents certain attacks.  closes #217 closes #325

  * /wsapi/have_email now returns { email_known: <boolean> }
  * /wsapi/stage_user now returns { success: <boolean> }
  * /wsapi/user_creation_status now returns { status: <string> }
  * /wsapi/complete_user_creation now returns { status: <boolean> }
  * /wsapi/stage_email now returns { success: <boolean> }
  * /wsapi/email_addition_status now returns { success: <boolean> }
  * /wsapi/complete_email_addition now returns { success: <boolean> }
  * /wsapi/authenticate_user now returns { success: <boolean> }
  * /wsapi/remove_email now returns { success: <boolean> }
  * /wsapi/account_cancel now returns { success: <boolean> }
  * /wsapi/logout now returns { success: <boolean> }

Finally, introduced middleware to ensure that resp.json() is not called with anything other than an object.

ensure users must authenticate every week (issue #309).  Also, move all magic numbers out of implementation and into the configuration abstraction.

This gives us end to end flow!  BOOOYA!

prove.ejs -> verifyemail.ejs
verify.ejs -> verifyuser.ejs

urls are the same - verifyemail, verifyuser

now that jwcrypto is a node module, we shall change the way that we include it (ie jwcrypto/vep rather than by relative path)

initial push toward the new design.  this is only for the site and does not include the popup.  serveral places are broken and marked with a XXX for fixing.

Conflicts:

	browserid/static/css/style.css

initial push toward the new design.  this is only for the site and does not include the popup.  serveral places are broken and marked with a XXX for fixing.

test harness now tries to shut down gracefully.  this allows cleanup to occur (i.e. of database when running in a test mode)

move secrets.js up to the libs/ dir.  it's useful that all code that uses random strings routes through the same abstraction so that we can later improve a single function.  a central location makes this (more) obvious.

move /csrf to /wsapi/csrf.  add /wsapi path to cookies, as all other requests should have aggressive cache headers.  Only create a csrf token when the client asks for it.  issue #173

add logging to CSRF token generation, and rather than throwing an exception when a mismatch is detected, log an error and return a bad request to the client (seems like a better fit than 'not authorized'). issue #173