Add credentialSecret to `Google.retrieveCredential`

I missed this one in 0fa591bc5.
Fix PollingObserveDriver error handling

The getRawObjects call can throw (eg, if you can't connect to the mongo
server for too long).  A few pieces of state were being corrupted in
that case:

- self._results was being set too early, leading to 'first' not being
  set on future _pollMongo calls, and_multiplexer.ready() never being
  called. This had two effects:

    - The observe (and thus any subscription) would never become
      ready().  Due to deduping, *no observe on this query* would
      ever become ready either.  This also implies that the
      observeChanges that are part of _publishCursor would never return,
      so the sub.onStop would never get called, so the observeHandle
      would never stop, leading not only to leaks, but for an inability
      for that query to ever stop being deduped with the corrupted
      PollingObserveDriver!

    - The onFlush calls would throw a "not ready" error instead of
      calling the callback, so (a) errors would be logged and (b) write
      fences would never be closed

  Fixed this by not writing to self._results at the top of the function.

- writesForCycle was being lost, so those write fences would never
  close. Fixed this by pushing writesForCycle back onto _pendingWrites
  if getRawObjects throws.
Fix accidentally-hardcoded Twitter URL in oauth1

Fixes #2154.
Add short aliases for '--add' and '--remove' options in "meteor authorized"

Fixes #2155
Deduplicate the "inherits" helper in Meteor package

Meteor._inherits is the way to go.
Clean up Session.destroy/Session.close.

Session.destroy is now folded in to Session.close. Server._closeSession
is renamed to Server._removeSession, since the `destroy()` call inside
`_closeSession` was always a no-op.