Allow arbitrary JSON objects to be stored in Session (but not compared with equals). Test Session. Fixes #215.
Merge branch 'devel' into auth

Pull in the issue #215 fix (Sessions can contain non-scalar objects)
Change interface for determining if the user doc is loaded to a new reactive
function Meteor.userLoaded(), which is true if you are logged in and the user
doc is loaded, and a currentUserLoaded Handlebars helper to match.

If logged in and the user doc is not yet loaded, Meteor.user() now returns an
object which only contains _id.

The current user subscription is now named meteor.currentUser rather than being
an unnamed sub. (loginServiceConfiguration is renamed
meteor.loginServiceConfiguration to match.) This subscription is sub'd from when
you log in and unsub'd from when you log out (or if you log in with different
credentials).

I was very careful to make sure that in the case of "sub #1, unsub #1, sub #2,
sub #1 is ready" we do not declare the user to be ready. I could have instead
modified livedata_connection to not call ready callbacks for unsub'd
subscriptions (add a "delete self.sub_ready_callbacks[obj._id]" to the self.subs
removed function) but this seemed less invasive.

The password and email tests use this to take a more rigorous approach to
waiting for the data to load, and they change the localStorage keys so that
multiple tabs running tests don't interact via localStorage.
Move "resume" login tokens from a separate collection into the user doc.
Include timestamps with the tokens, so that later we can set expiry/cleanup
policies.

Observable changes:

 - tokens can no longer be used to log in as a user which no longer exists

 - when you log in with a "reset password" link, all logins in other browsers
   lose the ability to reconnect. However, other browser logins are not
   immediately disconnected, and "change password" does not invalidate any
   tokens.
Add a comment about disconnecting sessions when users or login tokens are deleted.
Move email validation tokens into the users doc.
Accounts.changePassword: consistently allow no callback to be passed.
Make sure that "reset password" links validate the correct email address.
Fix change passwords flow (bug introduced in 147ef71).
Improve error reporting in Meteor.flush.
Hide fields and button on a successful password change.
accounts-ui: apply same fonts to dialogs
accounts-ui improvements

- additional class on the element with class "login-link-and-dropdown-list"
  with information about which of the three password flows we are in
- a wrapper element around each label/input pair in the password forms
- links to go back to the sign up flow from create account or forgot password
replaced 'currentInvocation.userId()' with 'currentInvocation.userId'
Make Meteor.user() reactive on user-loaded state. Fix #380.
Prefix all accounts-ui templates other than loginButtons with an underscore.

In the future we may support use of some of the sub-templates directly (eg, we
might expose a "sign in" template and a "create user" template, and keep the
events and links for switching between them on the outer loginButtons) but we
don't yet. This change leaves us open to change the internal details later.
dialog drop-shadow tweaks
give login-buttons DIV `display: inline-block`
Rename email 'validation' to 'confirmation'.
use CSS star hack
Make sure that the client doesn't get confused by an unsub followed immediately
by an identical sub.

Previously, it would fail to subscribe. This confused the meteor.currentUser
subscription in accounts_client.js. Reproduction:

  - Create user X with email (which sends a confirmation email)
  - Log out.
  - Log in as User Y in tab 1.
  - Follow the confirmation link in tab 2. This leaves you logged in
    as User Y.
  - Tab 1's localstorage poller notices that there's a new token and logs in
    with it.
  - After a successful login, Accounts._makeClientLoggedIn unsubs from
    meteor.currentUser and immediately resubs. It thinks there's already an
    existing sub, so it doesn't send the sub message and does immediately call
    the ready callback (which sets userLoaded() to true).
  - The unsub gets sent and the object in Meteor.users() gets depopulated.

Now Meteor.userLoaded() is true but Meteor.user() is empty.