tying loose ends with login/register, mostly surrounding success/fail redirects and messages. Also fixed verify and resetpass urls that get emailes to use req.headers.host variable to set domain:port instead of hard coding.
wired up privacy page to save to db
implemented connect-flash so redirects can receive parameters via session. (currently only /privacy uses this)
page for vin/hud, about, some privacy text