Restore login required on permalinks
Fix throttleSync, session persistence, and clocks

throttleSync previously used a key of "roomId" + "type" to determine
whether a message was the same type of message, and could therefore be
dropped.  However, since the message transport refactor last April, all
the "types" are simply "state", with paths, operators, and other crucial
details in the args.  Change this method to use a caller-defined key
instead.

Sessions were not being persisted server-side on changes to
connectedParticipants due to a missing return value.

Superagent requests seems to interact poorly with sinon fake timers --
in particular, clock restoration in the body of a request.end callback
seems to not work as expected, leading to at least some of the
inconsistency contributing to #267. Symptom is that "throttleSync" was
triggering functions, but never executing (the setTimeout was never
executing).  Fix this by re-establishing global timers manually.
Merge branch 'homepagedesign' of github.com:drewww/unhangout into homepagedesign