Update Node to 0.10.28 which includes our npm fix
Add credential secret argument to `retrieveCredential` functions.

Fixes #2118.
Doc and history updates for 4777e64336
Fix flakiness in "defer in rendered callback" test

It was flaky before because template rendered callbacks get called
after flush time, but not if the template got destroyed in the meanwhile.

The way this test was written, if the client managed to respond to the server
rejecting the method before the client's flush cycle, the rendered callback
would never fire. Thus it would hang, since that callback was wrapped
in an expect.

Now we define a method on the client only, which makes it run as a stub
without the server rejecting the method (ever).
shrinkwrap update from 314c8a1

Apparently not passing --force to npm install also allows us to do a
better job of not bundling duplicate npm packages.
Fix 0.8.1 regression in ROOT_URL with path

Fixes #2109.
Fix occurrences of "cd `dirname $0`"

They are not safe for spaces in paths. There might be other places to look for trouble.

I've run the following command to produce this commit: (on OS X, copy-and-pasting the below exactly)

    find . -type f -name '*.sh' -print0  |  # Find all .sh files
        xargs -0 fgrep -H -- '`'         |  # See all places with backticks in them
        fgrep 'cd `dirname $0'           |  # I deemed these problematic (variable assignments are safe)
        cut -d ':' -f 1                  |  # Take the <file> from <file>:<line> produced by "grep -H"
        tr '\n' '\0'                     |  # Also here, spaces can be problematic - always do "xargs -0"!
        xargs -0 -- sed -i '' 's/cd `dirname $0`/cd "`dirname "$0"`"/g'

The significance of adding the two levels of "'s can be verified by running the following in your Terminal:

    $ node -e 'console.log(process.argv.splice(1))' -- `echo 1   2`
    [ '1', '2' ]

    $ node -e 'console.log(process.argv.splice(1))' -- "`echo 1   2`"
    [ '1 2' ]

    $ node -e 'console.log(process.argv.splice(1))' -- "`echo "1   2"`"
    [ '1   2' ]
Typo
Looks like a typo (untested minor change)
Add missing amplify -> jquery dependency

Somehow this worked in 0.7.2 but starting at 0.8.0 amplify has a
ReferenceError.

Fixes #2113.
Set Content-Type header on js and css resources.
Set X-Content-Type-Options in browser-policy-content
nim, glasser comments
Add Content-Type to history
Merge branch 'content-type-headers' into devel
selftest: return null when reading a file that doesn't exist
Stricter validation of connect messages

Previously, you could leave out the "support" field (or claim to not
support the version you were proposing) which would mean your connection
would succeed iff the proposed version is the server's favorite
version. This led to (eg) ObjectiveDDP accidentally writing a client
that stopped working when servers started preferring pre2 over pre1. By
making this a blatant error, DDP client libraries are more likely to
be written in a way that works with version negotiation.

Also, remove the delay in sending connect failure messages, which was
intended to avoid connect storms from clients that are by now 1.5 years
old.

Fixes #2125.
Update commandline.html

Removed deprecated --password command from docs. Added info on new practices.
cleanup HTML
Merge branch 'pr/2117' into devel

Fixes #2117.