* Update the "stage_user" and "stage_email" to take a password where appropriate.
* Remove pass from calls to "complete_user_creation" and "complete_email_addition"
* Update database drivers to set the account password where appropriate.
* Update unit tests.

* Remove the forgot_password controller, templates, tests, etc.
* Update authenticate to trigger "new_user" with rehydration info
* Update set_password to be able to handle resetting passwords as well.
* Update the state machine to handle password setting or resetting.

* This fixes a problem where it is possible that a user takes more than 2 minutes to answer, making the already generated assertion invalid.
* A lot of general cleanup of the state machine.
* Push all post email selection flows to a new state, "email_valid_and_ready" which decides whether to ask the user the computer ownership status.
* Assertions are generated after the "is this your computer" is asked.
* doEmailChosen is replaced with doGenerateAssertion - there were multiple calls to generate an assertion, not very DRY.
* Fix a problem in network.js where a user who completes user registration should be marked as authenticated.
* rename email_chosen.js to generate_assertion.js to clarify its purpose.

issue #1460

re-work complete_email_addition to return faster in the case where a secondary email address is being added - mitigates issue #1445 for the purposes of a hotfix to train-2012.04.11

update loadgen for API changes - all apis which can authenticate a session or issue a cert now require an emphemeral argument - issue #1436

update loadgen for API changes - all apis which can authenticate a session or issue a cert now require an emphemeral argument - issue #1436

return HTTP 400 (bad request) when site or email parameters are malformed, not 500 (internal server error).  issue #1429 issue #1423

return HTTP 400 (bad request) when site or email parameters are malformed, not 500 (internal server error).  issue #1429 issue #1423

A bunch of changes to make the design more responsive to all screen sizes - mobile, desktop and tablet.

* Start with a slight refactor of the CSS and DOM.
* Vertical center content when content is smaller than the screen size.
* Constrain email addresses and show ellipsis if emails overflow box width.  Make sure width is updated when browser window size changes or user changes the screen direction of their device.
* If form/email address list is taller than available form area, show scroll bar on desktop or expand contents so that entire app must be scrolled on mobile.
* If dialog opened on a tablet or large desktop window, add a gradient to the left size of the white area that matches the gradient on the arrow.
* On mobile, footer should always be at the very bottom of the screen unless contents overflow screen height, where it will be pushed off the bottom of the screen.

Things to test and be aware of:
* Dialog should respond to various screen sizes when resizing browser window on desktop.
* IE8 does not support media queries so narrowing the browser window will not force the dialog into "mobile" mode.
* Contents in the "form area", wait, delay, or error screens should always be vertically centered.
* IE6/IE7 should still see the unsupported dialog with the correct layout (untested on checkin due to #1390)
* Wide emails should always be constrained to the screen width on mobile or box width on desktop.  The layout should respond to changes in device orientation.
* The box surrounding the emails should show a scroll bar on desktop/tablet if there are more emails the available screen height.  On mobile, the entire screen height should expand so that the entire app must be scrolled.
* On mobile, the footer should always be at the very bottom of the screen unless the form area takes up more vertical space than the device height.

issue #1101
issue #1317

fixed check for site parameter, it should be an origin not a domain, and fixed all tests accordingly. Was careful not to screw up the verifier tests that are testing for old parameters to the verifier.

issue #1351

API changes for public terminals/shared computers, and update all tests
to post data using JSON rather than form encoding, as the front end now does.

implement and test the prolong_session wsapi - which extends the duration of an existing session from the ephemeral duration (an hour) to full authentication session length (2 weeks) - doesn not change the start time of the session, so is a noop when invoked multiple times.  to be added to frontend code once user acknoledges ownership of device.

* Start with generic Firefox and iOS

issue #1167
issue #1302

Reusing staticPath in compress worker and making prefix configurable, removing DRY violation per llyod

add a ping wsapi that's registered on all daemons and does a light weight test of database health - closes #1324

fix bug where we wouldn't know the userid immediately after authentication.  return userid from authenticate_user api and set it upon successful auth.

when certifying secondary certs and the user has not confirmed their ownership of the given computer, certify with a short validity period

at authentication time, if the user has not confirmed ownership of a computer, set a shorter auth period.

return userid as part of session context, providing a key off which we can build shared computer support

purge all references to old persistent/remember me functionality - create local storage that keeps track of where you're logged in - wire up login/logout events to fire as appropriate on page load

revert accidental inclusion of 'AOK' in console output reporting web requests during dev - issue #1255

Adding disable_locale_check flag to skipping warnings for en-US without gettext files. Fixes Issue#1055