Modify to use SRP challenge and avoid exposing user details.

The existing implementation was very insecure, allowing anyone to
query the entire user collection by any profile field and retrieve
the full user document back.

This version uses and SRP challenge same as the accounts-password.

It also requires the app to whitelist a group of profile fields
which may be queried by the client exposed method.
update docs
remove console.logs and add email, username fallback
restore original order parameter for loginWithProfileField
plaintext password version for IE

IE8 complains about the SRP password exchange
because the script runs too long.

This login function uses plaintext password
exchange. It does not affect the use of SRP for
password exchange on the standard login functions.

ONLY USE IT IF YOU HAVE SSL/TLS ENABLED
case insensitive
Merge pull request #3 from singlow/master

Use SRP challenge instead of exposing entire user collection to the public.