don't reference external resources from browserid.org to not piss off SSL, and also a small pile of fixes to the testing harness -- specifically its handling of binary data, etc.

update testing harness to be compatible with new browserid run code.  host substitution is done at a much lower level to leverage more of the connect framework

figure out and implement the plumbing for users to confirm email addresses.  all that's left is actually sending email.  issue #3

simplify verifier a bit to make it simpler to use either off the same domain as browserid.org OR on its own domain.

more substitution fun in test harness.  find places where hostname:port is explicit without scheme prepended and get those subbed correctly (like in host-meta files)