lazy fetch csrf tokens in dialog immediately before a post request which requires them.  fixes csrf race condition in beta and dev

The request was assuming XML, which caused jQuery to blow its top since the response was not valid XML.  If we set the response to HTML, we can set the CSRF token directly from the response, without using response.body.

issue #177

fix manage page, now we explicitly call /wsapi/csrf so that the page itself can be cached. issue #74

move /csrf to /wsapi/csrf.  add /wsapi path to cookies, as all other requests should have aggressive cache headers.  Only create a csrf token when the client asks for it.  issue #173

improve CTA for users new to browserid.  closes #150 (maybe others won't agree with my solution.  let's try)

This keeps steal.build from trying to include 'csrf' as a file that needs compressed.

We want it to look good in Chrome as well!

close #158.

This keeps steal.build from trying to include 'csrf' as a file that needs compressed.

Fixes issue #147.

close #147

When hitting enter in a form, the first "input[type=submit]" or "button" is clicked.  We have to make sure the input[type=submit] is the first input element.

Cleanup.