refactor some billing code
update the tests
increase test coverage by going through the simplates
Merge pull request #3016 from gratipay/refactor-billing

Refactor some billing code
Document why we don't set httponly on csrf_token
Merge pull request #3031 from gratipay/document-httponly

Document why we don't set httponly on csrf_token
fix basic auth

fixes https://app.getsentry.com/gratipay/gratipay-com/group/45029121/
fix tests
show user ID on account page and update API doc in README
make sure we always have a user object in the context

fixes https://app.getsentry.com/gratipay/gratipay-com/group/45029122/
save a little memory
fix potential timing attack
backward-compatibility