Delegate to test/lib/index.js for mounting routes under /test/.

This will allow us to move all test-related app code there, instead of
scattering it about the codebase.

Also renamed test/browser to test/static.
CSP is now defined in res.contentSecurityPolicies.

The CSP headers aren't actually calculated until the 'header' event
occurs on the HTTP response, which gives middleware the opportunity to
add to the CSP. This allows persona-related domains to be added to
the CSP in persona-related code, and test-related directives to be
added to the CSP in testing code, rather than having it all centralized
in sescurity-headers.js and coupling that module to a bunch of other
ones.
Routes vs. middleware are now explicitly separated in app.js.

Previously, persona.js' express() function implicitly inserted
app.router into the middleware stack at the point it was invoked, which
made things confusing.

Now methods are called defineMiddleware() or defineRoutes() depending
on which they add, and app.use(app.router) is explicitly added in
app.js at a certain point, which should make things less confusing
going forward.
Merge pull request #3 from toolness/master

Better route/middleware management and better CSP middleware.