bumped client-sessions and hood
allow loggedInUser: false

fixes #4069
Check each component of the relay frame origin separately

The current check against the origin we craft will succeed in the
case of a URL which merely starts with the same text as the
crafted origin.

An example is a URL like "http://example.com@hostile.com" which
would match an origin like "http://example.com".

https://bugzilla.mozilla.org/show_bug.cgi?id=878485
Require a password-level authentication when confirming an email

Since a successful email confirmation leads to an authentication
level of "password", we should ensure that the user is already
authenticated at that level before going ahead with it.

https://bugzilla.mozilla.org/show_bug.cgi?id=908716
Changed timeout to 2 hours
Merge pull request #4091 from p0ffsrule/dev

Changed timeout to 2 hours

Fixes #3333
Merge pull request #4063 from seanmonstar/sessions-up

bumped client-sessions and hood
fix for cookies 0.3.8 not in lockdown.json
Merge pull request #4093 from seanmonstar/cookies

fix for cookies 0.3.8 not in lockdown.json
Fix for issue #3270: The xhr_delay error message doesn't specify which WSAPI call is timing out
Merge pull request #4094 from khuevu/dev

Fixes #3270: The xhr_delay error message doesn't specify which W...
Fix automation-tests for 797894f "Require a password-level authentication when confirming an email"
set secureProxy=true when running behind an ssl proxy
Merge pull request #4101 from jrgm/auto-test-fix-for-797894f

Fix automation-tests for 797894f "Require a password-level authentication when confirming an email"
Merge pull request #4071 from seanmonstar/allow-false

allow loggedInUser: false
test for wsapi client-sessions using ssl proxy
Fix #3866 - Use RP branding on login popup in main site.
Merge pull request #4108 from Osmose/rp-branding

Fix #3866 - Use RP branding on login popup in main site.
Merge pull request #4100 from jrgm/fixish-for-client-sessions-and-oop-ssl

set secureProxy=true when running behind an ssl proxy
send as content-type application/javascript to work with IE nosniff