fix race condition between token request and waiting for token, was causing test hangs.  closes #530

allow anyone running tests to define 'LOG_TO_CONSOLE' in their environment to get verbose logging output on the console.  issue #530

implement graceful process shutdown, and clear logging as to the reason why processes are terminating.  include winston handling of uncaught exceptions.  this all goes into a library that all of our processes use.  closes #529

in production (dev/beta/prod) use a more conventional logging format that includes timestamps.  closes #234

* Added some unit tests for verify_email_address
* Standardized ids and class names between verifyemail.ejs and verifyuser.ejs

close #528

Set the default text color to #000.  Used in the addon so text is not whi

issue #501

close #527

close #501

close #519

close #522

fix undefined reference (crash) in verifier after verification failure.  closes #523.  introduced in issue #82.

Creating one xhr mock function so that we test through the entire stack minus the network calls themselves.

* Create one xhr mock in qunit/mocks/xhr.js
* Use the xhr mock everywhere xhr functionality is used.
* Get rid of the network mocks and use the real network code to test the full stack.
* Updating the user unit tests to use this mock, which comes from network.

close #520

temporarily disable relay to keysigner until http forwarding logic is figured out/fixed - issue #460

add back an erroneously removed check in cert_key to verify that the authenticated user has verified the email which they are trying to get a certificate for - issue #460

fix a bug in validation library.  if we find a parameter validation error, don't call the next handler in the onion ring, fail out

fix CSRF checking logic, once we identify a single problem with the CSRF token, don't fall through to further checks

break 'checkParams' feature out into a separate file so it can be shared by multiple processes - issue #460

* user->requestPasswordReset now verifies user exists, handles throttling.
* add unit tests for the forgot page.
* do home grown form validation on the email.
* Print appropriate error messages and tooltips.

close #515

* stricter checks on email format - limit local, domain, and total lengths
* set maxlength of email fields in HTML

close #513

close #464