Substitute middleware.testUser() with lib/browserid.js stubbing.

The `testUser` middleware has a number of downsides: once present, a test user can't actually log out, and it also doesn't exercise the BrowserID integration code at all.

This commit changes things to stub out things at the points of integration with the BrowserID service, which makes it possible to test login/logout without actually talking to BrowserID. In order to do this, I had to add an export to `browserid.js` called `getIncludeScriptUrl()`, which usually returns the URL to the persona include script--but if testing conditions are set, instead returns a JS Data URI that stubs out `navigator.id.get()`.

From the docs I added to `lib/browserid.js`:

```
// The BROWSERID_TEST_USER environment variable is used for testing
// BrowserID/Persona without actually talking to the service.
//
// if defined, the environment variable should be either an email
// address, or the word 'error' or 'prompt'.
//
// In all cases, this module's exports are modified to
// have navigator.id.get() return a fake assertion on the browser side,
// and to have this module's verify() function process the fake
// assertion on the server side.
//
// If BROWSERID_TEST_USER is an email address, then the given user
// is always successfully validated.
//
// If it is 'error', then this module's verify() function always
// returns an error condition.
//
// If it is 'prompt', then the user is prompted for an email address
// when navigator.id.get() is called, and whatever they type is
// used as an email address. They can also enter 'error', in which
// case this module's verify() function fails.
```