Fix #896 - work around errors in pagination under Postgresql.
Fix style issue on user-image on Firefox and Opera

On both Firefox and Opera (OSX) the user image badge in
the settings page wasn't displayed.
Also, on firefox the badge overlay didn't have the proper size.

I don't know if there's a specific use case requiring a `display:
table` instead of a plain `display: block` but that was failing on
Firefox and Opera.

Using a block instead seems works perfectly (at least on Opera, Chrome,
Safari, Safari Mobile IOS7 and Firefox) regarding the badge size issue.

On Opera, though, the border radius wasn't applied properly to the
image. Adding a `border-radius: 100%;`fix that.
Add featured class when post is featured

fixes #1112
Save all settings when the logo or cover save button is clicked.

Fixes #1017.
- Call saveSettings for cover and blog logo photos
- Call saveUser for profile and profile cover photos
Simplify publish date checks

Fixes #814

- Changed to compare instances of `moment` using it's built in
comparison function instead of string compare with the date from the
database.
- Ensure compared date is parsed with the correct formats that we were
supporting before #1107.
- Moved date formats to variables to reduce chance for error in future.
Posts can now be featured by clicking on the star icon

fixes #1111
Fixed intermittent test errors

Fixes #1124

- Updated default mocha timeout to 15 seconds. Any future tests that
depend on a timeout (and thus might be better off with a lower value)
can override the default setting which is now 15 seconds.
- Removed test-specific timeout overrides for the mocha tests.
- Fixed the editor/splitbutton tests to wait for the appropriate
selector instead of assuming the dom has been updated immediately.
Should resolve intermittent timeouts when checking the splitbutton's
applied classes.
Improved test coverage of theme helpers.

refs #246
Merge pull request #1090 from bnchdrff/user-image-ff-fix

fixes firefox user image disappearance
Fixed further firefox display bugs

See #1090

Conflicts:
	core/client/tpl/settings/user-profile.hbs
Merge pull request #1026 from jenius/master

Remove unneeded info from /user api response
Security improvements

no issue
- added CSRF protection
- changed session handling to express.session
- changed session handling to change session id
- added config property useCookieSession
- added file extension check for /ghost/upload
- removed /ghost/debug/db/reset
Merge pull request #1 from sebgie/security

Security improvements
Remove private data from API

no issue
- added removal to user.browse, posts.read, posts.browse
- fixed removal for user.read
Updating to bookshelf 0.5.7 & knex 0.4.11
Merge pull request #2 from ErisDS/bookshelf-knex-update

Updating to bookshelf 0.5.7 & knex 0.4.11
Merge pull request #4 from sebgie/sec/3

Sec/3
API JSON updates
CSRF for debug screen
Set correct HTTP status code on error

closes #1055