* Remove obsolete css references.
* Move devise routing into Engine.
* All protected CMS pages redirects to cms/login when unauthorized.
* Uses /cms/users for session resources (i.e. cms/login, cms/logout).
* Got rid of cms_user/sign_in paths.
* Add title to Login Page.
* Clean up old session handling code.
[Remember Me] Use Devise functionality

To verify we 'are not being remembered' you must test in a non Chrome browser due to its behavior regarding sessions.

* Clean up all old 'remember me' code in favor of Devise.
[Reset Password] Allow users to reset passwords.

* /cms/login has link for forgot password.
* Use default application layout.
* Add titles for Forgot password.
Login should use application layout.
[Authorization] Menus

* Menus display correctly based on user's current ability.
* Allows guest actions (reset password, etc) to reuse same layout.
* Expired users should not be able to login.
* Document that passwords must be at least 8 characters long now. (Devise defaults are more secure)
New Password Encryption 

* Document release notes for devise and how it will require password resets.
* Clean up some model behavior thats no longer needed.
Use Devise's email validation.
* Move CMS specific devise configuration into the engine.
* Add devise secret key during upgrades and with new project generation.
Remove devise testing controller.
* Create 'public' /forgot-password page
* Uses the subpage template for now.
* Add a 'sub layout' for handling content pages.
* Add basic flash messages.
* Add page_title for login.
Refactor to extract ContentPage.
Add /login as 'public' login page.
On /login it links to /forgot-password.