Support for user email addresses

* User struct now has an .email property which can be get/set through
  the special REST API (:4985).
* GetUserByEmail() looks up users by email address; will be useful for
  BrowserID/Persona support.
* Channel names now allow '@' character since apps may want to use email
  addresses as channels.
More session work

* App server can create a session for a user by a POST to :4985/_session
* Some fixes for the regular public /_session API
Experimental (untested) BrowserID login support
Fix bug with empty _changes response

If there are no changes to report, the JSON response from _changes
should include "changes":[] instead of "changes":null.