sha1 and a bunch of fixes for UX.

Boo, very dirty working copy
server side validation including sha1
add normalize.css
styling improvements
have push task return a stream, and rename dev to watch
rewrites to make browserid paths work

requires secure_rewrites: false in config
updates to display elements.svg