Fixed #831 by fixing a typo in the test configuration.

When I encountered #831, it was because I had changed my `hostname` setting
in  `lib/environments/local.js` from `localhost` to a VMWare intranet IP
so I could  test the backpack from an IE8 VM. The test configuration was
overriding the `host` setting instead of the `hostname` setting, which was
the wrong one to override--hence the app harness was still going back to
the current config when resolving absolute URLs, instead of the test one.
Merge pull request #832 from toolness/issue-831

Fixed #831 by fixing a typo in the test configuration.
Substitute middleware.testUser() with lib/browserid.js stubbing.

The testUser middleware has a number of downsides: once present, a
test user can't actually log out, and it also doesn't exercise the
browserID integration code at all.

This commit changes things to stub out things at the points of
integration with the BrowserID service, which makes it possible to
test login/logout without actually talking to BrowserID. In order to
do this, I had to add an export to browserid.js called
getIncludeScriptUrl(), which usually returns the URL to the persona
include script--but if testing conditions are set, instead returns
a JS Data URI that stubs out navigator.id.get().

From the docs I added to lib/browserid.js:

// The BROWSERID_TEST_USER environment variable is used for testing
// BrowserID/Persona without actually talking to the service.
//
// if defined, the environment variable should be either an email
// address, or the word 'error' or 'prompt'.
//
// In all cases, this module's exports are modified to
// have navigator.id.get() return a fake assertion on the browser side,
// and to have this module's verify() function process the fake
// assertion on the server side.
//
// If BROWSERID_TEST_USER is an email address, then the given user
// is always successfully validated.
//
// If it is 'error', then this module's verify() function always
// returns an error condition.
//
// If it is 'prompt', then the user is prompted for an email address
// when navigator.id.get() is called, and whatever they type is
// used as an email address. They can also enter 'error', in which
// case this module's verify() function fails.