perform rigorous validation on all API parameters, cleanup redundancy in sanitize.js and validate.js - issue #1526

Signed-off-by: Lloyd Hilaiel <lloyd@hilaiel.com>

update the http_forward module to allow global request timeouts to be set, use this to implement a 15s upper bound on requests for declaration of support in development.  This should fix unit tests

when certifying secondary certs and the user has not confirmed their ownership of the given computer, certify with a short validity period

  * all database functions return an err as the first param which is non-null for failure.
  * all wsapis handle database errors and return service unavailable to client.
  * stalled-mysql-test implements unit tests to verify proper failure behavior of all wsapis.
  * configuration parameter added to define max allowed time per query

return an error to the client when we cannot contact the keysigner.  (was just leaving the connection to hang...)

document in code where two level auth affect apis, specifically where you'll need to be password authenticated, vs. where assertion auth (with a primary address) is sufficient

update all WSAPIs now that userid rather than email is stored in session after auth.  all tests pass on JSON database driver

initial implementation of request forwarding, cookies set from dbwriter are still not being properly passed through - issue #460

reorganize browserid process - break out view serving and wsapi handling.  preparation for dbwriter split.  issue #460