implement dynamic bcrypt work-factor update so we can scale this up or down as we seek the optimal security/performance balance

Beefing up tests for waitFor*.  Checking whether the returned status is 'complete', 'mustAuth', or 'noRegistration'

close #415

WSAPI CHANGES: All server responses are now objects, makes some funky browsers happy and prevents certain attacks.  closes #217 closes #325

  * /wsapi/have_email now returns { email_known: <boolean> }
  * /wsapi/stage_user now returns { success: <boolean> }
  * /wsapi/user_creation_status now returns { status: <string> }
  * /wsapi/complete_user_creation now returns { status: <boolean> }
  * /wsapi/stage_email now returns { success: <boolean> }
  * /wsapi/email_addition_status now returns { success: <boolean> }
  * /wsapi/complete_email_addition now returns { success: <boolean> }
  * /wsapi/authenticate_user now returns { success: <boolean> }
  * /wsapi/remove_email now returns { success: <boolean> }
  * /wsapi/account_cancel now returns { success: <boolean> }
  * /wsapi/logout now returns { success: <boolean> }

Finally, introduced middleware to ensure that resp.json() is not called with anything other than an object.

update to bcrypt v. 0.4.0 which includes .get_rounds and lets us perform on-the-fly work factor update.  issue #204

close #380

close #409

close #410

This allows the user to hit "enter" when only one email address is shown.  With only one email address, the radio button is not shown and we cannot submit the form.

close #412

If the user selects an invalid email address, show them an error message and re-display the valid email addresses.

The error message should be inlined, but I am going to open a new issue for that.

close #401.

In dialog_controller, if the passed assertion is null, email was not recognized or deleted, re-show the pick email.

issue #401

Warning the user, clearing all BrowserID stored info, and redirecting to main page when action is complete.

close #394

issue #137

close #404

close #405

certifyEmailKeypair, persistEmail, and persistEmailKeypair are no longer front facing but private.

removing confirmEmail, it was not used anywhere.

Renaming: waitForUserRegistration->waitForUserValidation
          emailRegistered->isEmailRegistered
          waitForEmailRegistration->waitForEmailValidation

Updating calls in the controllers.

Adding a test for isEmailRegistered with a non-registered email.

renamed:    ../../resources/browserid-errors.js -> ../../resources/error-messages.js
renamed:    ../../resources/browserid-network.js -> ../../resources/network.js
renamed:    ../../resources/browserid-identities.js -> ../../resources/user.js
renamed:    ../../resources/browserid-wait.js -> ../../resources/wait-messages.js
renamed:    browserid-network_test.js -> network_unit_test.js
modified:   qunit.js
modified:   storage_unit_test.js
renamed:    browserid-identities_unit_test.js -> user_unit_test.js

Updated all other files/tests accordingly.

fixing up removeEmail so that it does not pass on the removeEmail exception if email does not exist.

Cleaning up the unit tests so that we do not call clearStoredEmailKeypairs on every test but doing this in setup.

* renaming clearEmails to clear.
* Adding getEmail.
* removeEmail, invalidateEmail throw "unknown email address"
* add setSiteEmail, getSiteEmail.
* removeEmail will clear sites associated with that email address.

issue #1

log x-real-ip rather than remote ip in metrics stuff to get the proper ip in anonymous metrics logs.  closes #391