Added tests for plugin installation
Added no coverage pragmas to untested install code
Add a few headers to those always allowed by CORS.

Improved internal documentation about CORS headers and remove a few lines of vestigal code.

Improved security documentation.
Add vmstat to the travis build process so I can quickly see when travis is having a problem.
Merge branch 'master' into cors-headers
Merge pull request #580 from girder/cors-headers

Cors headers