fix content-type of host-meta, which ultimately repairs the local testing setup (substitution is not performed on stuff that isn't text)

add /code_update handlers to all servers to allow unpriviled users with localhost access on the machine to shut them down with an http request (for code update)

generate a persistent secret for cookie encryption at first server run.  still in pursuit of zero-config and as stateless as possible.

move to encrypted cookies for persistent auth with the IP, fix several usability bugs related to the abscense of this

clean up webfinger support in authority: use mustache for templating cause it's hot, include Subject tag, support & expect acct: prefix

refactor code a bit to move connect setup into run.js of the specific server.  this will make it easier to figure out how to run servers both standalone and in the test harness

implement localstorage caching of ids and pubkeys, stub out assertion generation crypto and use it from client code

migrate to the connect framework for node.js, specifically this provides session management middleware