Add statsd metric for looking up /.well-known/browserid

fixes #1704
report success and failure cases separately for fetch_well_known and deep_fetch_well_known statsd metrics.
Send along the start time and timestamp with the .well-known statsd metrics.
Place elapsed time into its own field in the log

```
{"elapsed":246,"level":"info","message":"elapsed_time.deep_fetch_well_known.error","timestamp":"2013-10-16T13:24:43.255Z"}
```
update convict from 0.0.6 to 0.4.1

anti bit rot
use express mounting, kill connect-cookie-session
Merge pull request #3980 from seanmonstar/express-use

use express mounting, kill connect-cookie-session

After @seanmonstar's updates to fix the requestKey problem, all good.

Selenium tests pass, backend tests pass, front end tests pass.  r+
remove obsolete reference to env.ZERIGO_DNS_KEY and env.PERSONA_DEPLOY_DNS_KEY; add a way to specify default domain with env.PERSONA_DEPLOYMENT_DOMAIN
Merge pull request #3973 from seanmonstar/convict-0.4.0

update convict from 0.0.6 to 0.4.0

tests pass, front end, back end and Selenium. Thanks for working with me @seanmonstar, the updates make configuration significantly more understandable. r+
Merge pull request #3984 from jrgm/de-zerigofy-scripts-deploy

remove obsolete reference to env.ZERIGO_DNS_KEY and env.PERSONA_DEPLOY_DNS_KEY 

Nice cleanup @jrgm. Ephemeral deployments work every bit as well as before this PR. r+
Avoid double-counting the /sign_in page when users return from authenticating with their primary.

* Instead of using the #AUTH_RETURN* hash, use ?AUTH_RETURN*, which is sent to the backend and can be used to avoid double count.
* /sign_in?AUTH_RETURN logs an `idp.auth_return` message
* /sign_in?AUTH_RETURN_CANCEL logs an `idp.auth_cancel` message
* Update tests.

fixes #3970
Log new primary users, send info to the kpi backend.

fixes #3985
Update how kpi.send_metrics config item is accessed - the namespace was updated yesterday in dev.
Merge pull request #3969 from shane-tomlinson/issue-1704-address-info-statsd

Add statsd metric for looking up /.well-known/browserid
new and shiny

update all the things!
Merge pull request #3971 from shane-tomlinson/issue-3970-sign_in-double-count

Avoid double-counting the /sign_in page when users return from authenticating with their primary.
a stateless "goldilocks" api

keeps current watch() api, but makes it "stateless" if RP doesn't want
session management. to indicate this, simply don't pass an `onlogout`
handler to watch().

navigator.id.watch({ onlogin: function(assertion) {} });
navigator.id.request(optionsAsNormal);
Merge pull request #3981 from seanmonstar/update-all-the-things

new and shiny
update db for convict's falsiness
Merge pull request #3993 from seanmonstar/convict-breakage

update db for convict's falsiness