update convict from 0.0.6 to 0.4.1

anti bit rot
use express mounting, kill connect-cookie-session
Merge pull request #3980 from seanmonstar/express-use

use express mounting, kill connect-cookie-session

After @seanmonstar's updates to fix the requestKey problem, all good.

Selenium tests pass, backend tests pass, front end tests pass.  r+
Merge pull request #3973 from seanmonstar/convict-0.4.0

update convict from 0.0.6 to 0.4.0

tests pass, front end, back end and Selenium. Thanks for working with me @seanmonstar, the updates make configuration significantly more understandable. r+
Avoid double-counting the /sign_in page when users return from authenticating with their primary.

* Instead of using the #AUTH_RETURN* hash, use ?AUTH_RETURN*, which is sent to the backend and can be used to avoid double count.
* /sign_in?AUTH_RETURN logs an `idp.auth_return` message
* /sign_in?AUTH_RETURN_CANCEL logs an `idp.auth_cancel` message
* Update tests.

fixes #3970
Log new primary users, send info to the kpi backend.

fixes #3985