Login hooks.

Adds `Accounts.validateLoginAttempt`, `Accounts.onLogin`, and
`Accounts.onLoginFailure`.

The process for logging in a user is consolidated in accounts-base,
which is now the only package which directly accesses login tokens in
the database.

All login methods now go through `Accounts._loginMethod`, which
ensures that exceptions are captured and login hooks are called in all
cases.

The callback hook implementation code from livedata is extracted into
an internal `callback-hook` package, where it can be used by accounts.
Merge remote-tracking branch 'upstream/devel' into login-hooks
Clone the attempt object passed to login hooks, so the original can't
be modified by hook callbacks.

Give the Hook constructor a named option to debug print and ignore
exceptions, as just passing in a string argument to do that wasn't
very clear.
Drop `knownUserId`.

This comes at the expense of the password login methods which now need
to explicitly return the user id with errors, but makes for a less
confusing flow of control.
Misc login hooks code review items
Be extra careful that password reset tokens are one-time use.
Fix call to Hook constructor in livedata
Merge remote-tracking branch 'origin/devel' into login-hooks
Add comment linking to hackpad.
Add history note.
restore login cancelled behavior.
Also report login failures that stop in beginPasswordExchange
Tweak error message.
fix id for navbar. this fixes scrolling highlighting
clean up docs a little
Merge branch 'login-hooks' into devel