[gem] update OmniAuth & code quality gems.

brakeman 1.9.2
flay 2.1.0
omniauth 1.1.3

Added ignore_files to churn report (ignoring files that are expected to change a lot, such as Gemfile.lock).
Setup for `app/wayground` to be used for non-ActiveRecord models.
[doc] updated the `doc/Developers/Testing.rdoc` documentation to reflect current practice for the project.
[CookieToken] format token strings for use in cookies.
[ParsedCookieToken] parse a token string, formatted for a cookie, into token and id.
[UserToken][User][Rememberer] refactor `User#remember_token` to a separate class.

Responsibility for the logic of remembering users is moved to the new `Wayground::Rememberer` model.

Responsibility for persistence of tokens to remember Users is now in the `UserToken` ActiveRecord model.

Setting of cookies in controllers has now moved to methods in the application_controller (`cookie_set_remember_me` and `cookie_set_remember_me_permanent`).
[CryptedPassword] wrapper model for crypted password values.

Used to check if a given plain-text password matches the crypted password.
[Password] crypting of password strings.
[User] move responsibility for password hashing from the User model to the CryptedPassword and Password classes.
[Login::Base] base class for extracting login (authentication) methods into their own classes.
[PasswordLogin] password authentication class (to be used to isolate from User model).

Added a `User.login_name_attribute` method so PasswordLogin doesn’t have to hardwire an attribute name.
[SessionsController][User] refactor password login authentication into PasswordLogin class.

Also sorted/grouped some of the methods in User, and added heading comments.
Code quality analysis configuration.

Adjust reek’s `TooManyStatements` check to ignore methods that are up to 9 lines long (instead of the default 5). Might lower it back down again once a lot more refactoring is done. For now, draw attention just to the really big methods.

Limit churn to look at file changes made since I started the big refactoring.
[OauthLogin][Authentication] refactor OAuth authentication into Login::OauthLogin class.

Moved the OAuth authentication logic from the `Authentication` ActiveRecord model into the `OauthLogin` class. (Separating persistence from logic.)

Changed behaviour when a user is logged in and authenticates with an existing authentication for a different user. It now changes the login to the different user.

Some cleanup of User model, `user_spec.rb`, and `sessions_controller_spec.rb`.
[Authority] fix exception.

Fixed the exception being raised by `Authority#merge_into!` when the source and destination users are not the same.
[preflight] Switch brakeman from rake task to command-line call (like nearly all of the other code analysis tools).

Also add the `preflight` script to the files ignored by churn, since it is being updated a fair bit, but that is not a reflection on the “churn” of the project code.
[Authority][AuthoritiesController] move logic from controller to model.

Also dropped the xml format responses since we’re not using those (yet?).
Let rake run when flay isn’t present (e.g., in a production-only environment).

Enclose the flay rake task in an exception catcher for when flay has not been loaded.
Remove unused XML format responses from controllers.
[routes] tweaks to `config/routes.rb`.

Move root route to top of file.

Add `format: false` to wildcard routes so any filename extension will be included in the path.