Allow optional max_uri_length server setting
Fix description of 414 error
Upgrade password hashes on authentication

We now upgrade user docs to the new PBKDF2 password scheme on successful
authentication if the password hash is still from the old days where we
only used plain SHA-1 for hashing salted passwords.

Closes COUCHDB-1780.
Configurable upper bound to _uuids count parameter
Verify that auth-related properties are well-formed

Passing unexpected values to auth fields can result in server
issues. Notably, setting "iterations" to a string will cause an
infinite loop as the comparison 'when Iteration > Iterations' will
never evaluate to true.

The latest validate_doc_update prevents user docs with this problem
and administrators can deploy that check themselves (and only
administrators can edit design documents).

A server administrator can also insist on lower and upper bounds for
iteration count to reject weakly protected passwords and
resource-hungry passwords respectively.

COUCHDB-2221
Support for user configurable SSL ciphers
Use `os:timestamp/0 instead of `erlang:now/0`

We don't need the guarantees of `erlang:now/0` in `make_cookie_time/0`,
so `os:timestamp/0` is just fine.
Use os:timestamp instead of now() wherever possible
Remove unused variable and function call

Finally get rid of that compiler warning.
Send a real EventSource event for heartbeat

The EventSource connection can get stuck (in TCP half-open state*) and there's no way
for the client to detect that. This commit changes the way heartbeat is sent, instead of
sending a newline character, it sends an empty event of type heartbeat:

    event: heartbeat
    data:

This event doesn't have an id: field, so the client will retain its latest Last-Event-ID state.

This doesn't change the expectations of clients that used EventSource till now, because they
subscribe to the 'message' event type. To get the 'heartbeat' events a client will need to
explicitly subscribe to it:

    source.addEventListener('heartbeat', function () { /* cancel a timer that would otherwise reconnect the source */ });

* this can happen when you suspend your laptop, on flaky internet connection, ADSL reconnect,
bad wifi signals, bad routers etc. Pretty often in a typical internet usage nowadays.
Support `fail_if_no_peer_cert` ssl option