xblocks: Add mentoring, image-expl, dragndrop, ooyala, group
xblock-external-ui: Add XBlock API call to render XBlock views

Included commits:
* xblock-external-ui: Include CSRF token in the API answer
* xblock-external-ui: Adds support for CORS headers (cross-domain request)
* xblock-external-ui: Include full path when building local_url
* xblock-external-ui: Fix TestHandleXBlockCallback & bok_choy, add tests
* xblock-external-ui: Only return `instance` in `_invoke_xblock_handler()`
* xblock-external-ui: Group resources by hash tag to avoid duplicate loads
* xblock-external-ui: Alternate referer check for CORS requests
* session-cookie-httponly: Allow to disable httponly on session cookies
* remove errant log message
Enforce type of the XBlocks Fields when set

This updates the XBlock dependency to edX/XBlock@***
and add the newly introduced enforce_type methods

Also contains:

* Add xmodule fields enforce_type tests
* xblock-fields: Update hash of XBlock repository
Update django-splash.

The new release supports wildcards in path exclusion rules.
api-v1: Initial API implementation & group relationships

Includes:
* Initial API implementation
* API_KEY header fix
* Fixed indentation error
* move api from common to lms
* Course-Group Relationships
* wip
* add parsing of overview content blob
* initial implementation
* get course updates API method
* get course static tabs API methods
* add unit tests
* fix some merge conflicts and remove some extra print statements picked up in rebase
* better constrain some of the course url regexs to expect a triple for courseId
* add ability to enroll users into courses
* wip
* add queryable group lists
* add a GET endpoint to /api/groups/{groupid}/courses to get the list of courses associated with the group (program)
* return the display names when listing all courses in a group (program)
* create optimized course tree query API endpoint
* make sure group profile data is properly serialized and deserialized. There appears to be a difference between how the Django test client handles things. Disabling unit test for now to unblock UI devs
* null guard
* fix broken unit test
* add GET endpoint to group/user relationships
* Added Security to session api as requested in #785
* Storing passoword history of user and validation for user's email and username
* Moved security tests to lms also
* add two FEATURE flag overrides to enable the security features
* remove unnecessary settings overrides (because they are 'feature flags')
* Adding ratelimiting on login api
* Migrated from Function-Based Views to Class-Based-Views
* Create new Account/Login Audit Log
* The API should provide for an audit log when a user creates a new account or logs into the system.
* UserList.post() now creates UserProfile, UserPreference records
* Group Profile fix
* Filter group subgroups by group type
* Application reorganization
* Name is now required during group creation
* Added null check for profile name
* User must reset password functionality added
* User must reset password dunctionality added
* Added user password reset functionality
* Add password reset api and implemented Password history
* Remove unused imports, password reset message text
mattdrayer/CLIENT-932: API - Enables editing of User data
mattdrayer/api-quality: Quality updates
fields_need_visible_updatable_via_api_761: merged with master
apply_group_type_filter_1013 merge with master

apply_group_type_fiter_1013 added request parameter in delete function of UserCoursesDetail
https://github.com/edx-solutions/edx-platform/pull/43
mattdrayer/api-timestampedmodels: Derive models from TimeStampedModel
mattdrayer/api-modulesgroups: API - Added grouping capability for courseware content
cdodge/fix-updates-parsing: seems like studio now uses a different HTML formatting, e.g. sections & articles rather than ol & li

make backwards compatible to read older versions of Studio produced updates

add some tests
New API to get users

Added new API to get enrolled and not enrolled users in Course Content
Group: MCKIN-1027

Also contains:

* Changes base on Matt's Feedback
* Further changes based on Matt's feedback
mattdrayer/api-userdetailpostfix: Addressed several issues related to updating user/profile information

FInal fix
mattdrayer/api-modulesgroups: API - Added grouping capability for courseware content

initial commit

add tests

back out config change
added "due" field to CourseContentDetail
mattdrayer/api-groupidfix: Changed model reference to 'group_profile'
mattdrayer/api-csrftoken: Include CSRF token in the response payload
asadiqbal08/api-address-based-restriction:API Security: IP address based restriction added MCKIN-1108

uncomment the code
cdodge/get-ip-restriction-list-from-config: change settings name to make clearer and make sure we are getting values from lms.envs.json