JSON API

Changes include:
- Added JSON paths to `config.py`
- Added `_logout_user()` in `login.py` for handling logging users out (via destroying session cookies and `UserSession` in NDB datastore.
- Added `HTTP/1.1 400 Bad Request` error handler in `login.py`
- Added `json_object()` function to `User` class in `users.py`; will return a publicly displayable User object (i.e. what to return in JSON requests).
- `_login.json` via `JsonLogin` will: return information about a logged in user; log out a user; log in a user.
- `_login/create.json` via `JsonLoginCreate` will: create a new user.
- `_login/activate.json` via `JsonLoginAcivate` will: activate user accounts (email verification)
- `_login/password/change.json` via `JsonLoginPasswordChange` will: change the logged in user's password.
- `_login/password/forgot.json` via `JsonLoginPasswordForgot` will: send a password recovery email.
- `_login/password/reset.json` via `JsonLoginPasswordReset` will: reset a user's password (and verify a token is valid).


Closes #3; Closes #18