Keep track of open DDP connections by login token.
Add method that logs the user out everywhere.

Might need some UI work; currently causes confusing error message "Couldn't find
login token."
Preserve the connection that called logoutAll.
Rename to Meteor._logoutAllOthers
Wait 10 seconds before closing other logged-in sessions.

Gives other tabs sharing a token with the caller time to find the new token in
localStorage. This is sort of a hack for now; one possibility for making it less
hacky is to add a DDP disconnect message to allow the server to tell clients
that they are being disconnected but can reconnect with the provided token.
Expire login tokens periodically.

When a login token expires, all open connections associated with that token will
be closed. It will be up to client code to avoid trying to connect with a login
token that is set to expire soon.
Store login token on livedata session.

Allows us to remove sessions from sessionsByLoginToken when they are destroyed.
Make client aware of token expiration times.

accounts-password will not try to auto-login with (and will clear) a login token
that is going to expire within an hour, to try to avoid abrupt disconnects from
an expiring token. Login handlers return a new tokenExpires field to help the
client do this. Made tokenExpires a separate field on the login handlers' result
object instead of just returning the whole token (token + when fields) in the
result to avoid breaking code that assumes that login handlers return a string
as the token field. The tokenExpires field is optional, so other login handlers
that don't set it aren't broken.
Make token expiration times configurable via Accounts.config.
Add token expiration test and fix bugs so it passes.

Also make all token-expiration-related times configurable via Accounts.config.
Add experimental "disconnected" DDP message.

Client uses this to unset user id when a forced logout happens.
Add test for Meteor._logoutAllOthers.

Fix bugs to make it work.
Allow DDP client to register onDisconnect callback.

accounts-base uses this to handle disconnects due to users being intentionally
logged out.
Close users' connections when they or their tokens are deleted.
Remove DDP disconnected message.

Instead, using a friendlier error message for bad login tokens, and preferring
localStorage tokens to the result of login method in onReconnect (since
onReconnect doesn't get cleared because we don't have a disconnected message to
know when to clean it). Also tried to make tests a little cleaner.
On logout, disassociate connection from token before deleting token.
Test for logging out a user's connections when deleted.

Tests are flaky, not sure why yet.
Clean up token deletion and tests.
Merge branch 'expire-tokens' into devel