separate customs (fraud / abuse) server

This moves the customs functionality to a new repository, currently https://github.com/dannycoates/fxa-customs-server

## Dev environment changes

To ease the transition this change adds the new server as a dependency. In development the npm scripts start the customs server in the background with its default configuration. It **does not** start memcached for you.

To test the auth-server and the customs server together requires a local memcached process running on the default port 11211. `npm start` and `npm test` default to not using the customs server for easier dev. The `npm run test-all` script does use the customs server and requires memcached to be running beforehand.

## Stage / Prod changes

An ElastiCache memcache instance is required. The customs server will run from the node_modules of the auth-server and be monitored by circus in this release. A future release should move customs server to its own CF template.

## Logic changes

The rate limiting logic has been *slightly* improved.

* Added IP and User-Agent data points
* The blocking period doesn't get extended on each subsequent request
* Failed login attempts are now per IP/email address pair
* All endpoints that require a password report failed attempts
* Data is stored in memcached instead of process memory

## Config addition

```json
{
  "customsUrl":"http://127.0.0.1:7000"
}
```

## Logging additions

Yet another log file... 

Each endpoint has a line `request.check` and `request.failedLoginAttempt`. Examples:

```json
{"name":"customs-server","hostname":"moz.local","pid":14390,"level":30,"op":"request.check","email":"47abcab6e77b14fb2374@restmail.net","ip":"127.0.0.1","block":false,"msg":"","time":"2014-04-21T17:20:54.475Z","v":0}
```

```json
{"name":"customs-server","hostname":"moz.local","pid":14390,"level":30,"op":"request.failedLoginAttempt","email":"2d079326c45939297fc2@restmail.net","ip":"127.0.0.1","msg":"","time":"2014-04-21T17:20:53.254Z","v":0}
```

Memcache errors are logged with `"op":"memcachedError"`

## QA

The customs-server doesn't have unit tests yet.

There are currently two conditions that will lead to a request being blocked. Either an endpoint that requires a password has used an incorrect password more than 2 times in the last 15 minutes from the same IP address, or an endpoint that sends email has been requested more than 3 times in the last 15 minutes for the given email. The expected behavior includes:

* once a limit has been exceeded affected endpoints will be blocked for 15 minutes
* the rule that is triggering the block doesn't count requests while it is blocking
* tracking data expires after 15 minutes
* at the end of a block interval the rule starts from a clean slate
* the auth-server should allow requests when there's an error or failure of the customs-server

The limits and block interval are configurable, but it currently requires some manual intervention. If you need help with this please let me know.

## TODO

User-Agent based rate limiting is not functional. The user-agent validation function is not implemented.