Fixes username floating bug #263
Remove fadeDuration declaration from npm-exapnsions following #360
adds hubspot tracking to vendor.min.js
adds hubspot tracking to csp
Merge pull request #425 from npm/add-hubspot-tracking

adds hubspot tracking to vendor.min.js
Add a repl to web servers.

The socket for a specific server is named `www-<port>`. Each server
will log its socket file name at startup. You should run
`./node_modules/.bin/rc /tmp/repl/www-<port>.sock` to connect to the
repl. For dev servers, `npm run repl` will connect to the socket
named after the usual development port, as a convenience.
Merge pull request #439 from npm/ceej/replify

Add a repl to web servers.
Fixed #417: rendering applet file tags from readmes

The readme sanitization code was effectively a no-op because of a
code sequencing error. elevateLatestVersionInfo() was being called
*after* readme sanitization and replacing all the cleaned data with
unsanitized original content. Because it wasn't being called, the
markdown & sanitization process was likely always failing anyway.

Made several changes to improve code readability & clarity, as well
as to fix the bug:

- Changed the name of package() to match how it's used: presentPackage()
- Moved elevateLatestVersionInfo() to much earlier in presentPackage()
- Changed parseReadme() to no longer require a callback, since it isn't
  actually async
- Restructured parseReadme() so that all paths through it, including the
  code path where marked parsing fails, return sanitized data. It no longer
  can return an error.
- Defended against null readme blocks being passed into parseReadme().
- Fixed a problem in the package route where the `pkg` variable from a
  callback was shadowing an existing variable.

The package to use when testing this fix is `benchmark`, which has now been
added to the list of common packages that a dev installation will replicate.
Minor tweaks to fix #417

* Moves elevateLatestVersionInfo() to the top of the package presenter
* Removes an extraneous console.log
updates service tests to use lab 4.x.x
Adds test case for packages like benchmark that previously failed to be sanitized.

The major issue with the `benchmark` package was that its readme wasn't at the top level. As a result, it wasn't being elevated to the top level and then sanitized before being served to the registry. This test ensures that even older packages (circa 2012, which is before we forced all packages to have readmes at the top level) are sanitized.

* Takes registry data for test package (`benchmark`)
* Ensures mocked methods serves the correct registry info
* Tests that the package is sanitized to html from markdown
guess who finally added jshint to their setup?
adds more thorough testing

* null/undefined readme fields do not throw exceptions & cause all package prep to fail
* readmes that make marked throw are still sanitized
* readmes that aren't identified as markdown are sanitized
* readmes that are not at the top level & need promotion are sanitized
* readmes that are stored in files as not markdown are sanitized
* readmes that are stored in files as markdown are sanitized
adds SESSION_SALT to travis builds, fixes #423
Merge pull request #447 from npm/travis-env

adds SESSION_SALT to travis builds
don’t show “it will be yours” on 404 page if package name is invalid
Add `npm publish` to 404 page instructions

Very cute 404 page :-)
Merge pull request #418 from bslayton/#263-username-floating

Fixes username floating bug
Merge pull request #420 from sudodoki/remove-fade-leftovers

Minor cleanup for frontend js code - remove unused variable
add blockquote styles