Fix globals in wsapi.js that seemed to be created unintentionally and fix the modules that depended on implicit globals

implement a 'maximum request time' for bcrypt work.  server now fails more gracefully under backbreaking load, returning 503s to clients of the authenticate_user api.  update loadgen to be less dramatic about, but still display, 503 errors.  first part of issue #787 - a partial fix for #785 in dere too

implement graceful shutdown of bcrypt compute processes.  fix bcrypt.get_rounds (was throwing an exception)