Permalinks live reloading support

issue #1395
Adds login limiter

Closes #499
* On wrong passwords, statuses: `active` -> `warn-1` -> `warn-2` -> `warn-3` -> `locked`
* On login check, if user's status is `locked`, login automatically fails and user is encouraged to reset password. Does not even bother to check for passwords.
* login attempts tell user how many attempts she has remaining in notification box
* successful login will reset status to `active`
* resetting password with forgotten password emailed token resets status to `active`
* complete with a test suite
Direct api access for app proxy

- proxy doesn't need a ghost object :)
Fix excerpt/content helpers

fixes #1591
- Convert quoted strings to numbers
- Update code examples
- Update helper tests
Merge pull request #1586 from jgillich/live-reloading

Permalinks live reloading support
Merge pull request #1589 from javorszky/iss499

Adds login limiter
Merge pull request #1593 from ErisDS/app-proxy-update

Direct api access for app proxy
Merge pull request #1594 from halfdan/1591-excerpt-helper

Fix excerpt/content helpers
Add url.resolve for password reset email url

fixes #1604
Serving static assets via asset-rack

closes #1405
- adds asset-rack to package
- moves all assets previously served via express.static into a rack
- handles url generation for statically served assets
- updates the asset-helper for hbs-templates to get the right url