An initial attempt at a backpack-connect model, with tests.
added hasPermission() to backpack connect session model
added .isExpired() to backpack connect session model
Added backpack connect SessionFactory.

Argh, the second options argument to the Session constructor doesn't get
called when the model's static methods like find(), findOne(), etc are
invoked, so I had to make a factory for use with tests. Ugh.
added permission validation to backpack connect session model.
Added controller for backpack connect.

This controller is fairly generic/configurable, and can be used in the
future w/ any kind of service that wants to offer what effectively
amounts to a sort of "federated oauth".
Replaced issuer.js's OpenBadges.ROOT w/ OpenBadges.getRoot().

This will be needed for other scripts/modules/etc. to be able to
get at the root URL.
Added a very simple OpenBadges.connect() implementation in the built issuer.js.

The implementation just redirects the user's browser the backpack's access
page (the controller+route for which haven't been implemented yet).

Ultimately an intermediary will be doing the work of figuring out what
the backpack's endpoints are.
Merge branch 'development' into backpack-connect-model
Factor out a new module, test/issuer-utils.js, from issuer.test.js.

This will allow us to reuse issuer-utils in backpack connect integration tests.
Added backpack connect endpoints in app.js and integration tests.

A few things have TODOs around them; this is a work in progress.
base64 decode authorization bearer tokens for backpack connect.
backpackConnect.authorize() middleware now also sets request.user.
Added an optional 'permission' arg to backpackConnect.authorize() middleware.

This makes the authorize middleware check to ensure that the given
permission exists on the passed-in access token before allowing the
request to proceed further.
The /api/issue endpoint now works.

This commit reveals inconsistencies in the way errors are reported to
backpack connect clients, though: a lot of my code just returns a
text body containing a description of the error, while other errors
are reported solely through the WWW-Authenticate header as per rfc6750,
while the errors returned by the issue endpoint are JSON blobs.

We should probably update the backpack connect draft spec to explicitly
specify what needs to be returned when error conditions occur.
Added a basic /access view.

I don't like the inline JS in the page, but the existing logic in
static/js/badge-accept/badge-accept.js is pretty coupled to the
issuer frame, and we're going to be migrating to use the observer
API in #511 anyways, so the code will likely be pretty temporary.
Ensure clients of /api/issue can only push badges they issued themselves.
Added middleware.utils.createSecureToken() and made backpack connect use it.

Note that the function currently calls the synchronous version of
crypto.randomBytes(). This was done so I wouldn't have to re-engineer
backpack connect's model to work asynchronously, and hopefully shouldn't
be that huge a deal right now because backpack connect tokens aren't likely
to be created/refreshed that often. However, we can change it to work
asynchronously if needed.
add CORS support to backpack connect.
added backpack connect test page to fakeissuer.