call session destroy after logout to prevent bogus empty session created in redis
force upgrade on new user
add version and platform to tests
only save username in session
check for null user when getting apnToken;remove validator;allow ios 3:3
don't create session until user created successfully; destroy session on passport validation failure; validate validate params;don't create session on unauth'd methods
Merge branch 'master' of github.com:surespot/web-server