Sanitize user input and move from GET to POST

Almost all important (and not using redirects) actions are now
performed using POST rather than GET requests.  This will make
CSRF protection much easier in the future.

Validation has also been added through the express-validator
package, to sanitize some inputs.

Jira issue: WP-781
Include anti-CSRF middleware in PZH Web Server

The PZH Web Server was horribly vulnerable to CSRF attacks, particularly
as it offers so many powerful POST interfaces and relies on a single
log-in system.

This commit fixes the problem by using the connect csrf middleware, and
refactoring a lot of the code to be two-stage rather than one-stage
events.

In addition, the main page has been refactored into a number of templates
for ease of use, and to enhance readability.

Jira issue: WP-781
Add CSP headers and HSTS support

The PZH Web Server now implements a weak CSP policy (defined in
config.json) and supports HSTS headers.

Jira issue: WP-731
Change PZH identities to nicknames, not emails.

The signup page now requires users to enter a nickname
rather than just using the found OpenID address.

Jira issue: WP-959
Fix user address to be nickname@pzh.webinos.org

This set of changes fixes certificate exchange also, and implements
caching of the 'hasPZH' status of users on the PZH WS.

Jira issue: WP-959
Fix crash on certificate exchange

Remove invalid CSRF check and fix certificate request bug.

Jira issue: WP-959
Bug fix for CSRF issue with inter-zone certificate sharing.

Jira issue: WP-959
Fix for inter-zone certificate exchange bug.

Using nickname, not email

Jira issue: WP-959
New way of fetching certificates from another PZH

Jira issue: WP-959
Fixes for inter-zone certificate exchange: use email not nickname

Jira issue: WP-959
Add the external nickname during certificate exchange

Not used for authentication, but for getting the right entry in
'untrustedList'

Jira issue: WP-959
Remove logging and debug messages

Jira issue: WP-959
Merge remote-tracking branch 'upstream/master' into add-nicknames-for-pzh-users
Fix enrolment and simplify.

Enrolment was needlessly complicated.  The authentication code has
been removed, and the session handling improved to provide some
feedback to the user.  Message names have been fixed.

Jira issue: WP-959
Allow Google, Yahoo and OpenID logins to give return URLs.

This then allows us to run the PZH Web Server on a port
that is different to the public-facing port.  E.g., running
locally on port 8080 and then using iptable to port-forward
to port 80.

Jira issue: DEVPORTAL-9
Merge pull request #7 from jplyle/support-auth-urls-and-ports

Support for callbackURLs in the Google, Yahoo and OpenID logins