[Devise] Refactor to use as Authorization

Devise is now used as the primary authentication mechanism for BrowserCMS. All of the existing login behavior has been refactored to it under the covers. Old login portlets have been refactored/deprecated in favor of built in login pages.

* Add Forgot Password feature
* Add /login /login and /forgot-password paths that use CMS templates.
* GET /cms/login works
* GET /cms/logout works
* GET /cms/user.json returns current user for views.
* Can now configure existing ContentPage controllers.
* Use only new encrypted passwords.
* All protected CMS pages redirects to cms/login when unauthorized.
* Menus display correctly based on user's current ability.
* Allows guest actions (reset password, etc) to reuse same layout.
* Use asset silencer gem rather than custom code
* Document that passwords must be at least 8 characters long now. (Devise defaults are more secure)
* Add Cms::ContentPage as new mixim. Handles specifying templates using :only, :except options.
* Login/Forget Password portlets use devise, but are deprecated going forward.
* Replace 'ResetPassword' portlet
* Make template for login pages configurable (Use: cms.templates = {}) default: 'default'
* [Portlet Blacklists] Add a portlet blacklist so they can't be created
* Forgot, Dynamic, and Login portlets are blacklisted by default.