moved the grsec lock sysctl task to a separate role.
added tasks to check if the grsec lock option was available and if not boot into grsec kernel.
this role can be skipped by adding the 'restart' or 'grsec' tag.
fixed hostnames in the securedrop-prod playbook
Will split this up prior to submitting pr.
But moved the tasks to install the fpf/tor repos and run apt-get update are still in the common role.
The grsec kernel gets installed as part of the common role but it is not used until the server reboots.
The servers are not set to reboot if needed until the last role run ubdate_boot_grsec.
This role checks to see if the grsec sysctl lock is available if not it will reboot
After the reboot if the grsec sysctl lock is not set it will set it.

Still having an issue with the server somtimes not coming back up. I copied the production ansible.cfg to see if that would improve anything.
I added aptitude as a dependency to use the built in ansible module to update the system instead of having unattended-upgrades via an ansible command module peform the action. Not sure if my issue were due to this.

ansible_ssh_host is how the host checks to see if the server is up.
ansible_ssh_host is the same variable we have in the example production inventory file. It is also the same variable used by vagrant.
for use with vagrant will need to disable host_key_checking. Production ansible.cfg is in install_files/ansible-base/ansible.cfg and does not disable this option
updated ansible command in playbook
Include changes suggested by @ageis
Add Google Authenticator instructions for Android
Updated user manual for 0.3 (todo: screenshots)
Updated with changes from @garrettr
The JavaScript warning really is a popup, not a separate page
Journalists need username, password, 2fa to log in
Nitpick on javascript warning
Split and merge full_install.md into separate, related docs

Also updates instructions, formatting, and cleans up whitespace.
Update grsec kernel build docs to latest built kernel

* Updates the docs for Ubuntu Trusty (14.04.1) because we switched to it for SecureDrop 0.3
* Updates versions of grsecurity patch and linux kernel to the versions used in the most recent successful build of the grsecurity kernel
* Fixes some formatting and trailing whitespace issues
Tip for speeding up dd on Mac OS X
Harden setuid binary for Tails torrc helper
moved the grsec lock and unattended upgrades tasks to the common role. This will cause the server to reboot if needed before applying any other hardening (ssh/iptables) that would affect being able to access the server
split the remove ossec exemptions into two roles so that could control the order that the ossec agent server were restarted.
removed refs to the build-securedrop-app-code and securedrop-ossec roles since we are migrating to pbuilder and those roles will not be the real process.

added a role to install local packages the variable to set what packages should be installed in this host_vars section
instead of the pip module trying to read a file on the local system's shared mount point (/vagrant) use the file packaged with deb package.

also removed task to install the dependencies that the deb package installs.