figure out and implement the plumbing for users to confirm email addresses.  all that's left is actually sending email.  issue #3

simplify verifier a bit to make it simpler to use either off the same domain as browserid.org OR on its own domain.

more substitution fun in test harness.  find places where hostname:port is explicit without scheme prepended and get those subbed correctly (like in host-meta files)

add /code_update handlers to all servers to allow unpriviled users with localhost access on the machine to shut them down with an http request (for code update)

during sync emails, we only sync issued identities for now, manually set issuer to the one and only secondary (eyedee.me)

if the user comes into the ip with a valid cookie pointing to an unknown email address, purge the cookie.  this happens upon database purge

in source urls are now all (interim == eyedee.me) live, the test harness subs in testing urls & hostnames