implement graceful process shutdown, and clear logging as to the reason why processes are terminating.  include winston handling of uncaught exceptions.  this all goes into a library that all of our processes use.  closes #529

in production (dev/beta/prod) use a more conventional logging format that includes timestamps.  closes #234

implement graceful process shutdown, and clear logging as to the reason why processes are terminating.  include winston handling of uncaught exceptions.  this all goes into a library that all of our processes use.  closes #529

in production (dev/beta/prod) use a more conventional logging format that includes timestamps.  closes #234

fix CSRF checking logic, once we identify a single problem with the CSRF token, don't fall through to further checks

WSAPI CHANGES: All server responses are now objects, makes some funky browsers happy and prevents certain attacks.  closes #217 closes #325

  * /wsapi/have_email now returns { email_known: <boolean> }
  * /wsapi/stage_user now returns { success: <boolean> }
  * /wsapi/user_creation_status now returns { status: <string> }
  * /wsapi/complete_user_creation now returns { status: <boolean> }
  * /wsapi/stage_email now returns { success: <boolean> }
  * /wsapi/email_addition_status now returns { success: <boolean> }
  * /wsapi/complete_email_addition now returns { success: <boolean> }
  * /wsapi/authenticate_user now returns { success: <boolean> }
  * /wsapi/remove_email now returns { success: <boolean> }
  * /wsapi/account_cancel now returns { success: <boolean> }
  * /wsapi/logout now returns { success: <boolean> }

Finally, introduced middleware to ensure that resp.json() is not called with anything other than an object.

ensure users must authenticate every week (issue #309).  Also, move all magic numbers out of implementation and into the configuration abstraction.

This gives us end to end flow!  BOOOYA!

prove.ejs -> verifyemail.ejs
verify.ejs -> verifyuser.ejs

urls are the same - verifyemail, verifyuser

now that jwcrypto is a node module, we shall change the way that we include it (ie jwcrypto/vep rather than by relative path)

initial push toward the new design.  this is only for the site and does not include the popup.  serveral places are broken and marked with a XXX for fixing.

Conflicts:

	browserid/static/css/style.css

initial push toward the new design.  this is only for the site and does not include the popup.  serveral places are broken and marked with a XXX for fixing.