Final checkpoint for new login forms - serve downloads as static assets from MarkLogic, avoid need for apache mod_rewrite protection

config/navigation.xml - add download-via-curl page
config/sever-urls.xml - go back to ports - no need for apache mod_rewrite to handle download protection
config/template.xhtml - add in tryml bits for download-via-curl page
controller/access.xml - add /download for static asset access.
controller/forbidden.xqy - avoid the template - just a simple text response.
controller/url_rewrite.xqy - forbidden now checks for current user and allows in creds via request params as an alerternate
js/functions.js - add a link to the download-via-curl instructs.
lib/users.xqy - add authViaParams utility
view/tag-library - add required attibute to profile form, remove title from confirm dialog