more issue #598 - add test and fix for other places where exceptions leak out of JWCrypto and cause 500 errors rather than 200 failure responses.

the verifier is more helpful if you leave off content-type headers, also did you know we support application/json?  closes #643

(loadgen) add -u option that allows one to specify a numeric range which will make load testing with a large database possible - issue #504

(loadgen) implement assertion generation in loadgen client, hook up signup and signin flows - issue #504

(loadgen) now starts up, generates 30 keypairs, adds 30 users - simulated signup mostly updated to new apis - issue #504

repairing load_gen - issue #504 - update pathing, alter fake_verification WSAPI to query the database rather than to use email interception (which no longer works)

initial implementation of request forwarding, cookies set from dbwriter are still not being properly passed through - issue #460

add the dbwriter process.   it's not yet hooked up, but starts up and runs, and included in health check.

reorganize browserid process - break out view serving and wsapi handling.  preparation for dbwriter split.  issue #460

remove CORS from repository.  In-repo example now properly forwards requests to verifier from server.  closes #245

implement graceful process shutdown, and clear logging as to the reason why processes are terminating.  include winston handling of uncaught exceptions.  this all goes into a library that all of our processes use.  closes #529

in production (dev/beta/prod) use a more conventional logging format that includes timestamps.  closes #234

implement graceful process shutdown, and clear logging as to the reason why processes are terminating.  include winston handling of uncaught exceptions.  this all goes into a library that all of our processes use.  closes #529

in production (dev/beta/prod) use a more conventional logging format that includes timestamps.  closes #234

fix undefined reference (crash) in verifier after verification failure.  closes #523.  introduced in issue #82.

fix CSRF checking logic, once we identify a single problem with the CSRF token, don't fall through to further checks