Create views for index and secret

Put secret and index in views, rather than `render :text => ...` so that layouts are automatically pulled in.
Limit grant flows

For now MyUSA will only support `authorization_code` grant flow.
Initial pass at non-public/sandeboxed client applications

This isn't actually working yet. Specs to test this functionality have been marked pending
Allow user to update profile as part of the OAuth flow

- created text fields in the authorizations page that correspond to profile fields from requested scopes
- disabled text fields that are already filled out (can change styling so that they don't look like text fields)
- use profile.update_attributes with whitelisted profile hash to save fields
- model, controller, and capybara tests where appropriate
- removed a few unused methods
- TODO: organize FIELDS and METHODS constants in profile so it's easier to access them elsewhere
capture profile validation failure and display errors

Redirect back to authorization page when profile.update_attributes(...) fails. Call the redirect with the same OAuth authorization params and set flash message to error.
Merge branch 'devel' into feature/update-profile-in-oauth-flow

Conflicts:
	spec/features/doorkeeper/oauth_spec.rb
Minor refactor to profile save in AuthorizationsController
Add some technical info about MyUSA

Based on @yozlet's request, put what MyUSA is in addition to
what it does.
Add the fact that we're an account system

Yes, we manage accounts.  And you can log in a variety of ways.
Merge pull request #142 from 18F/hotfix/README

Add some technical info about MyUSA
Merge branch 'devel' into feature/oauth-sandbox

Conflicts:
	spec/features/doorkeeper/oauth_spec.rb
Implement Private/Sandboxed Apps

- migration to add public field
- added current_user in initialization of Doorkeeper::OAuth::Client
- method on Doorkeeper::OAuth::Client to check validity of the client app for the current user
- override Doorkeeper::OAuth::PreAuthorization#validate_client to check client.valid_for?(...)
Merge remote-tracking branch 'origin/feature/scope-mockups' into devel
Merge branch 'devel' into feature/update-profile-in-oauth-flow

Conflicts:
	app/helpers/oauth_helper.rb
	app/views/doorkeeper/authorizations/new.html.erb
	spec/features/doorkeeper/oauth_spec.rb
	spec/support/page_objects/oauth2/authorization_page.rb
Merge branch 'feature/oauth-sandbox' into devel

Conflicts:
	app/controllers/oauth/authorizations_controller.rb
	spec/features/doorkeeper/oauth_spec.rb
Set rails session timeout to 2 hours
Update secrets.yml.example

When the Devise initializer was changed to reference secrets.yml, this was not updated.
Merge pull request #159 from 18F/feature/update_secrets_yml_example

Update secrets.yml.example
Merge pull request #158 from 18F/feature/session_timeout

Set rails session timeout to 2 hours
Support legacy token request via authorization endpoint

legacy implementation used POST /oauth/authorize for both the user facing
authorization screen and the API endpoint to request a token ... so, we
have to support it here.