Added security items.

https is forced.  Auth cookie sets secure flag.  Added X-Frame-Options header.   Added HSTS header.  Removed server and frameworke headers.  Added validation for login return urls.
Added custome error pages for 500 and 404.
All cookies except for 'theme' are set to httpOnly.
Merge branch 'master' into develop
Removed EF and replace it with raw ADO.NET and a handrolled database migration strategy.