coffee-script dep bumped to 1.6.x

i hit a strange bug in 1.4 while working on xml.builder.
make check would bomb with something like

  [object Object].push(qs) in lib/lo/common.coffee
          ^^^^^^  unexpected identifier

it worked with 1.5 already, but why stop there? ;)
GET /gallery/appliances: response transform
GET /gallery/appliances/:app: response transform
GET /gallery/appliances/:app/comments: response transform
GET /gallery/appliances/:app/rating: response transform
GET /gallery/appliances/:app/software: response transform

fixture gets pruned, the volume was adding no value.
GET /gallery/appliances/:app/testdrive: response transform

fixture gets pruned, the volume was adding no value.
GET /gallery/appliances/:app/versions: response transform
xml#transform has async interface

takes (err, rv) -> as the last argument.
user#transforms: consistent typo in gallery urls

appliance -> appliances.
/appliance/:app/configuration response update

it now includes info on GPG key for SLMS integration.