don't put X-Requested-With headers on all XHRs, makes it more likely that CORS will work
mostly extract an OAuth2 credential base class
make Google and Dropbox auth drivers active by default
tweak Google keyring image css
Merge branch 'basespace' into subtracks_semzoom

Conflicts:
	themes/base/keyring.css
	themes/base/scss/keyring.scss