fix(server): Add a 'connect-src' directive to allow contact with the auth-server and oauth-server

fixes #1253
Extract csp middleware logic into its own file.

* Update the tests to ensure CSP is served when expected.
fix(client): Replace calls to [].indexOf with _.indexOf for IE8 support.

fixes #1263
fix(strings): fix reset password link error messages

The invalid and expired error messages were using verification link strings and markup
when they should use reset password strings and markup.
Replace the tests that used `String.prototype.indexOf` and `Array.prototype.indexOf` to use `assert.include` for clarity.
fix(css): Remove the blue background on select element focus in IE10+

fixes #1016
fix(test): Remove cache busting URLs in dev mode.

* If `static_max_age` is set in `local.json`, .JS files are served with a maxAge of 0 already. ETags will still be checked.
* Enables the use of browser dev tools. With dynamic cache busting URLs, filenames would change from one run to the next.

fixes #1145
fix(client): Remove keyboard accessibility for the show/hide button.

* Set tabindex=-1 for the show/hide password field button.

fixes #1239
fix(client): Throw an exception if invokeHandler is passed an invalid handler.

* This will help devs catch errors faster.

fixes #1105
fix(client): Abort autofocus events if no element exists with the `autofocus` attribute.

fixes #1109
Merge pull request #1277 from mozilla/issue-1109-autofocus-forever

fix(client): Abort autofocus attempts if no element exists with the `autofocus` attribute.
Merge pull request #1275 from mozilla/issue-1145-no-cache-in-dev

fix(test): Remove cache busting URLs in dev mode.
Merge pull request #1279 from mozilla/issue-1239-disable-show-pw-tabindex

fix(client): Remove keyboard accessibility for the show/hide button.
Merge pull request #1274 from mozilla/issue-1016-ie10-select-highlight

fix(css): Remove the blue background on select element focus in IE10+
Merge pull request #1264 from mozilla/issue-1263-indexOf

fix(client): Replace calls to [].indexOf with _.indexOf for IE8 support.
Merge pull request #1276 from mozilla/issue-1105-blowup-invokeHandler

fix(client): Throw an exception if invokeHandler is passed an invalid handler.
CSP middleware cleanup based on @warner's feedback.

* Only add the CSP middleware in dev mode.
* Simplify the requiresCsp check - url.parse is not needed, express already has req.path
fix(oauth): only show service name if it is defined

Fixes #1216
Merge pull request #1281 from mozilla/issue-1216-undefined-service-name

fix(oauth): only show service name if it is defined
feat(client): add expired verification link message and a email resend link