merge latest dev into upgrade-jwcrypto branch, porting fixes to verifier's support of delegation of authority to new jwcrypto apis

Reusing checkSupport to implement delegatesAuthority in lib/primary. 

update the http_forward module to allow global request timeouts to be set, use this to implement a 15s upper bound on requests for declaration of support in development.  This should fix unit tests

Start the verifyEmailAddress page controller even if there is no token.

Updating documentation in cookiesEnabled to include Android 4.0 default browser still passing the cookiesEnabled check with cookiesDisabled.

close #1542

added conformance tests.

tests should now pass
updated to jwcrypto that has proper callback delay guarantees and removed unnecessary setTimeouts

Updated all calls to jwcrypto to use the more intuitive API. Fixed a front-end test that was failing due to true asynchronicity of jwcrypto.

Ensure the cookies disabled check does not run on /tos, /about or /privacy

Fix the global variable introduced and other JSHint errors.

To test:
* Make sure verification works if a valid token is given.
* Make sure error message is displayed if invalid token is given.
* Make sure error message is displayed if no token is given.

issue #1495

* Create a list of pages where the cookie check should be run.

issue #1514

issue #1521

unbreak auto-deployed dev by updating deployment image - previous had a database pre-created which is no good when we change the schema.

wsapi code cleanup: always name the response 'res', never 'resp'.  also fixes several bugs in error handling code.  closes #1277

closes #290, closes #1000

don't require that a user re-enter their password in dialog after email verification in a different browser.  Because the user just typed their password, attempt to authenticate them in the verification originating browser via the API.  If that works, then automatically log them in

* user.js: Update verifyEmail and verifyUser to take a password.
* network.js: Update completeEmailRegistration and completeUserRegistration to take a password.
* Replace verify_email_address.js and add_email_address.js with a single verify_secondary_address.js to reduce duplication.
* Update the templates.
* Bring back verify_email_address and add_email_address templates, but remove the verify password field.
* To dom-jquery, add show, hide functions.

unit tests which excercise verification of emails in a "different browser" from whence verification is initiated

require authentication on complete_* wsapis to reduce risk now that password is provided before email verification.  issue #290 and a pre-requisite for issue #1000

remove delay in primary-then-secondary test that was introduced in issue #1445 and is no longer neccesary with the movement of password selection to dialog

* /wsapi/complete_email_addition no longer has to bcrypt the password, so the previously mentioned race condition should be a thing of the past.
* in pages/start.js, signUp is now a module so it has to be started.
* in controllers/actions.js doEmailConfirmed is no longer an action and is no longer needed.

* Move #thisIsNotMe button handler from the page_module to pick_email.
* Remove extra tests for the authenticate controller.
* use the alias for BrowserID.User in helpers.js
* Add password fields to the forgot page.

* helpers.addEmail triggers either "primary_user" or "add_email_submit_with_secondary"
* Add states to the stage machine to handle add_email_submit_with_secondary to either set a password or stage the user.
* Add two helper functions in storage.js, addPrimaryEmail and addSecondaryEmail

* Verify the user without checking for passwords on the verification pages.
* Update /wsapi/stage_email to take a password.
* Remove the password fields of the verify page forms.
* Set the password when adding an email address.

* Update the "stage_user" and "stage_email" to take a password where appropriate.
* Remove pass from calls to "complete_user_creation" and "complete_email_addition"
* Update database drivers to set the account password where appropriate.
* Update unit tests.

* Remove the forgot_password controller, templates, tests, etc.
* Update authenticate to trigger "new_user" with rehydration info
* Update set_password to be able to handle resetting passwords as well.
* Update the state machine to handle password setting or resetting.

* Update set password to handle either initial password set or a password reset
* Update network/user.js to handle passwords when creating new users or resetting passwords.

Change the order of assertion generation to be after the user is asked "is this your computer?"

Update remaining reset_password test to deal with new flow when the user confirms the address.