fix(avatars): load profile image on settings and sign in pages if available

 This refactor changes a number of things:
    * fix avatar background (fixes #1722)
    * loads profile images on settings and sign in account chooser (fixes #1727)
    * introduces User and Account models
    * imports old Session based sessions into User
    * handles direct link to settings page from RPs for a specified account (fixes #1686)
    * redirects unverified accounts that visit /settings (fixes #1716)
    * introduces a way to pass ephemeral data between views
    * removes unused avatar-change-via-URL resources/tests (fixes #1544, fixes #1618)
We can also start to use `self.getElementValue('#old_password')`, but out of scope for this PR.