Fixing bug that effectively broke document support in 0.4.0.. how embarassing :(

This fix sponsored by Christophe Drevet.  Thank you!
Release notes v0.4.1 ... fixes serious issue with conversion via libreoffice.

This commit sponsored by William Linna.  Thank you!
only check password if there is a store_hash
remove the list from response.vary. not sure why I was getting an error using openid without it, but everything seems to be working fine now
need to use .get('messages') to not get a keyerror
PyTest needs to be >= 2.3.1
Fix by Rodney Ewing so render_http_exception works with newer Werkzeug versions.

This commit back-cherry-picked from current master for the 0.4.1 fix release.
Updating docs regarding pulling in and fetching git submodules

We use this for PDF.js now... we should reference that.

This commit sponsored by Bonnie King.  Thanks!
Merge branch 'release-0.4.1'

Conflicts:
	mediagoblin/_version.py
A few small formatting fixes on the release notes
Merge remote-tracking branch 'refs/remotes/rodney757/misc'
Revert "remove the list from response.vary. not sure why I was getting an error using openid without it, but everything seems to be working fine now"

This reverts commit 05ceada051dad011bb9b3e1c93fb42b2d9875939.

It turns out the reason for this in the first place was werkzeug
backwards compatibility.