Deal with any security issues from shared dev apps

EDIT: Original title: __Remove config for shared Bitbucket dev app__

Now making this about overall concern, not just Bitbucket

---------------------

[IRC](https://botbot.me/freenode/gittip/msg/12911701/)

Bitbucket does not offer scopes, just full access to public and private repos for any app authorized to act on behalf of the user. We should revoke permissions on the app ASAP (if not done), and alert those who may have been effected. Unfortunately, it might be hard to do that if we've already deleted the app, but we should get in touch with BitBucket to find the users who we may have exposed to danger.

I think the worst part is that categorically the people who were at risk are the developers who took the time to spin up gittip and hack on it :(

### To Do

- [ ] disclosure post (asap? after we have usernames?)
- [ ] contact bitbucket support for usernames
- [ ] alert affected individuals on bitbucket by email
- [x] ~~confirm that github never asked for a scope greater than default (ie. "no scope", which is read-only)~~ [https://botbot.me/freenode/gittip/msg/12916152/]
- [ ] confirm that venmo always asked for read-only perms
- [ ] confirm that twitter always asked for read-only scope
- [x] ~~confirm that bountysource is safe~~ [https://botbot.me/freenode/gittip/msg/12914627/]
- [ ] ~~dig up old convo where we decided this was okay in the first place~~ [lost to the sands of time](https://github.com/gittip/www.gittip.com/pull/2239#issuecomment-39516150)
- [ ] decide how we're going to implement local dev auth going forward

------------------------------------
EDIT2: <a name = "risk-summary" />

attack surface = platform * permissions * users

| Platform                 | Permission | [Time Period](http://bit.ly/1lssE72) |
|-------------------------|----------------|---------------------|
| Samurai | ? | Never |
| Stripe | ? | Never |
| Balanced | ? | Jul 18, 2012 - Apr 3, 2014 |
| Bitbucket | public/private read/write ([default](https://confluence.atlassian.com/display/BITBUCKET/OAuth+FAQ#OAuthFAQ-DoIhavegranularcontrolofOAuthpermissions%28scopes%29?)) | Mar 22, 2013 - Apr 3, 2014 |
| Bountysource | ? | May 23, 2013 - Apr 3, 2014 |
| GitHub | [`(no scope)`](https://developer.github.com/v3/oauth/#scopes) | June 6, 2012 - ? |
| GitHub | [`user:email`](https://developer.github.com/v3/oauth/#scopes) | ? - Apr 3, 2014 |
| OpenStreetMaps | [?](http://wiki.openstreetmap.org/wiki/API_v0.6#Retrieving_permissions:_GET_.2Fapi.2F0.6.2Fpermissions) | Oct 6, 2013 - Apr 3, 2014 |
| Twitter | [read-only](https://dev.twitter.com/docs/application-permission-model#announcement) | Sept 13, 2012 - Apr 3, 2014 |
| Venmo | ? | Jan 7, 2014 - Apr 3, 2014 |