Start doing the socket.io-powered single page app thing.
These express.io-style events have more of a chance of being usable.
Moved all the socket.io stuff to its own single-page app so I can experiment
safely away from the rest of the app.
Added some security middleware from helmet().
Added level-session-csrf for csrf token support. Decorated all forms with tokens;
spot-checked a bunch of them but not all yet.
Started implementing support for gravatar avatars & for avatar.io avatars;
this is incomplete.
avatar.io avatar upload, complete with spinner for upload-in-progress.
Bumped version.
Merge pull request #1 from ceejbot/socket.io

avatar support for real