replaced expect.js with chai
migrated all client qunit tests to mocha + chai (async failures still ugly)
lodash path changed (bower will solve this eventually)
WIP spike on different way to work disallowed routes