[api] robust error handling and reporting
[api] sessions are now pulsable and retrievable

The session can be polled for its status and the user it identifies for
dummy clients.

User, account, and session views now return a media node that provides
API endpoints for dependant objects.

API request parameter parsing has been delegated to the API Sinatra
helper module.
CORS support
ported account transactions, modified drilldown view

Breaking changes:

  * withdrawal and deposit transaction endpoints are no longer
    strongly-typed but instead the type of tx is provided as a
    required argument to a generic "/accounts/:account/transactions"
    endpoint
  * yearly and monthly drilldown JSON views no longer segmentize
    transies by date segments, but instead list them as an array
    and it is now left to the client to segmentize as fits the interface
  * PUT support is deprecated, use PATCH for partial mods instead
added support for daily drilldown
account API retrieval endpoint support
[auth] OAuth support for referer redirection
[resources] integrated CanCan for implicit resource access checks

The API Helper module will now implicitly enforce an access permission
check for every resource listed in the :requires[] route condition, and
will halt with a 403 if access is unprivileged.
DataMapper Validation map JSON support for error reporting
CORS support
upgraded category endpoints
upgraded payment method endpoints
[rt] a note must now be provided, fixed an issue with monthly recurrence
account labels are now unique per user scope
category names are now unique per user scope
deprecated Pibi#salt method and friends and some User model bugfixes

* User models now implicitly destroy their linked slaves
* User models now implicitly encrypt passwords in a before filter
* Fixed an issue with users trying to link to themselves
* There's an issue with Notices not being cleaned up properly, a hack is
  used in a before :destroy filter to manually remove them
upgraded transaction endpoints

**Breaking Changes**

All transaction endpoints are now properly scoped within their account
scope as per the mapping below. Also, deposits and withdrawals are no
longer strongly-typed but are instead specified as a :type required
argument, and recurrings now have their own scope.

* OLD: /deposits/:deposit_id
* NEW: /accounts/:account_id/transactions/:transaction_id

* OLD: /recurrings/:recurring_id
* NEW: /accounts/:account_id/recurrings/:recurring_id

This distinction between Recurrings and other types of Transactions
should lead to clearer code as they diverged in almost everything beyond
the base properties.
Using CanCan ability
Upgraded the specs and robustified em
initializer breakdown