make cookie_secret configurable

allows config to specify logins that survive across server instances (default behavior unchanged).

Depends on PR #3372
rollback #3358

closes #3391

For users who need to hide the scrollbars while zooming text in the meantime, you can add the following to your custom.css:

```css
.CodeMirror-scroll, .CodeMirror-wrap .CodeMirror-scroll {
  overflow: scroll;
}

.CodeMirror-vscrollbar, .CodeMirror-scrollbar-filler, .CodeMirror-hscrollbar {
    visibility: hidden;
}
```
add note about sharing config files with cookie_secret
Merge pull request #3373 from minrk/cookiesecret

make cookie_secret configurable

Allows config to specify logins that survive across server instances (default behavior unchanged).

Add warning about not sharing config files with cookie secret.
Merge pull request #3401 from minrk/rollbackcmcss

rollback #3358

#3358 was a workaround for a CodeMirror (actually Chrome seems to be the one at fault) bug drawing scrollbars over text, when there isn't anything to scroll. The workaround was a compromise, always drawing the space for the scrollbars to prevent the overlay, but reducing the margin so it isn't quite so annoying in the ~99% of the time that there are no scrollbars. It turns out (#3397, #3399) that the margins are not reliable, so the margin adjustment could cause the very same problem.

closes #3391, #3397, #3399

For users who need to hide the scrollbars while zooming text while we wait for a CodeMirror release, you can add the following to your custom.css:

.CodeMirror-scroll, .CodeMirror-wrap .CodeMirror-scroll {
 overflow: scroll;
}

.CodeMirror-vscrollbar, .CodeMirror-scrollbar-filler, .CodeMirror-hscrollbar {
   visibility: hidden;
}
or just put CodeMirror master in your profile's static/components directory.
Skip, on Windows, test for root home directory
test Config objects from dicts
fix creating config objects from dicts

ensures that sections are subconfigs, such that:

```python
cfg = Config({'Class' : {'trait' : value}})
```

results in the same object as

```python
cfg = Config()
cfg.Class.trait = value
```

Previously, this would not cast the `Foo` dict to Config,
which would cause merges to fail, etc.
make Config.merge a public method

leave Config._merge as deprecated alias.
Merge pull request #3403 from minrk/configinit

fix creating config objects from dicts, make Config()+merge public 

ensures that sections are subconfigs, and that:

cfg = Config({'Class' : {'trait' : value}})
results in the same object as

cfg = Config()
cfg.Class.trait = value

_merge() renamed to merge, and keep a deprecated _merge() alias