Sending email was missing the from field
using base64 caused an occasional token string to contain '+' which resulted in a space being embedded in the token.  'hex' should always produce a url safe string for the token.
Merge tag 'v1.7.2'

1.7.2
Make verifications url safe
Allow app.model() to accept a DataSource instance
Add hidden property support to models
fix to enable ACL for confirm link sent by email
Merge pull request #216 from strongloop/fix/verification-token-url-safety

Make verifications url safe
test: add hasAndBelongsToMany integration test

* it allows to find related object via URL scope
  GET /api/categories/{cat-id}/products

* it allows to find related objects via where filter
  GET /api/products?filter[where][categoryId]={cat-id}
  (skipped for now)

* it includes requested related models in `find`
  GET /api/categories/findOne
      ?filter[where][id]=CAT-ID&filter[include]=products

* it includes requested related models in `findById`
  GET /api/categories/{cat-id}?include=products
  (skipped for now)
Merge pull request #220 from strongloop/feature/add-test-for-include-hasManyThrough

test: add hasAndBelongsToMany integration test
Add hidden property documentation
Update user.js

Corrected spacing on confirm ACL, removed extraneous comment on using hex rather than base64
Merge pull request #219 from dougtoppin/fix-verify-confirm

Fix verify confirm
Merge pull request #217 from strongloop/feature/hidden-properties

Feature/hidden properties
1.7.3