Require password to change account info

Don't clear current login token when changing password.
Remove the session on expiry, not the cookie
Use a more secure method to generate tokens
Minor cleanup of superuser toolbar

Something is still broken, though
Fix superuser cookie
Remove lazy on superuser val

Trying to fix this non-deterministic request.access problem
Check for and handle duplicate files

Die in the case of a hash collision.
fixes assembla-244 simpler than expected.
Merge remote-tracking branch 'remotes/origin/master' into angular
Merge remote-tracking branch 'remotes/origin/master' into angular
broken; work on authService, toolbarCtrl, contextbar, etc.