First pass at leave functionality

This PR adds a new API method: "/conversation/leave" that takes POST requests from users.  The purpose of this function is to allow users to leave a given conversation.

On the backend, most of the code should be similar to the 'delete' function in conversation.js.  It has been repurposed to only remove a single user from the conversation instead of all.  Once the number of participants is 0, the conversation itself and associated posts are deleted.

On the frontend, the choice modal's submit event is registered to make a POST request to "/conversation/leave" if the modal was opened by clicking on the leave link.
So, somewhat confusingly, `_csrf` isn't an underscore-related thing at all.  It just happens that the backend middleware (code that handles requests) that validates requests reads from the `_csrf` key by default.  To be honest, I'm not sure about the details behind CSRF, but functionally, it adds a layer of security by forcing all requests to contain this 'token' that is generated by our servers.  That way, a malicious hacker couldn't just write and fire a $.post from his or her own website towards our url with the same parameters.

Yup, exactly.  Sometimes requests are GET, sometimes they are POST requests, usually just depending on whether we are sending data or not.