FeatureController:
  - ensures user has access to vendor on create/edit
  - validates access token
move model class to Models directory
VendorCredentialController.Create ensures the vendor accessed is authorized
PrivateKeyController secured so it checks the user has appropriate rights to add/edit keys for the affected vendor
test cleanup
PrivateKeyController.Post now has a confirmation screen  / is a POST request
moving some test setup classes around
inlining some methods used by TransactionController
registration link on login page properly tracks returnUrl,
TransactionController.ClaimLicenses no longer has a post step
Have test for manually created transaction that uses existing customers.
TransactionController.Checkout cannot have different transactionId injected
TransactionController.Checkout makes sure existing customers exist (when used).