update to latest build

* dont expand account on login attempt (change in stormpath.js)
* expect sptoken in the jwt body, not as a url param
* create error.html