reorganize browserid process - break out view serving and wsapi handling.  preparation for dbwriter split.  issue #460

Signed-off-by: Lloyd Hilaiel <lloyd@hilaiel.com>

now that jwcrypto is a node module, we shall change the way that we include it (ie jwcrypto/vep rather than by relative path)

move secrets.js up to the libs/ dir.  it's useful that all code that uses random strings routes through the same abstraction so that we can later improve a single function.  a central location makes this (more) obvious.

generate a persistent secret for cookie encryption at first server run.  still in pursuit of zero-config and as stateless as possible.