Remove leftover TODO comment

The TODO has been done, but the comment was still around, making it seem
like the permissions refactor was still to be done when actually it's
been finished.
Add "Allow invite-a-friend" project setting (NYI)

It does nothing yet, but it defaults to true and can be persisted. Next
commit will actually do something with it: if it is false, managers can
still use the invite-a-friend feature but contributors cannot use it.
Add new API: SessionCommands::getSessionData()

Instead of setting up all the session data in the App controller class,
we'll set it up in a separate SessionCommands API function, allowing it
to also be called from the Javascript side of things (via something like
sessionService.refresh()). We also have an API for accessing public
settings (that is, settings that are not security-sensitive) on a
project, and the session data will contain those settings by default.

This will allow the "Invite a friend" directive to look up the project
settings by just looking at the session data, without the need for any
further JSON-RPC calls and server round-trips. It should also allow
several similar things in the future.
Make invite-a-friend directive use new session API

Now that the session contains the current project settings, as well as
the user's current project rights, the session contains everything
needed for the invite-a-friend directive to figure out whether it should
display itself or not.
E2E test: move "use" statement to right place

All "use" statements in setupTestEnvironment.php need to come after the
require_once('e2eTestConfig.php') statement, so that its config values
(like SF_DATABASE) can be correctly applied everywhere.
Update invite-a-friend E2E test

Now that we have a setting for turning off the "invite a friend" feature
for normal users, we should incorporate that setting into our E2E test.
Add PHP tests for SessionCommands API
Merge branch 'refactor/sessionApi'

New API call: session_getSessionData or SessionCommands::getSessionData

From Javascript, no parameters needed, and sf.php will fill in the
current projectId and userId. From PHP, pass in projectId and userId.
Remove debug statement in session PHP test