Highly experimental custom sign in

As a title says this is very experimental and I'm not sure if it actually going to make it to the core `gae-init` or in `gae-init-auth` or in a completely separate project.. since many people were asking for it.. I decided to give it a shot.

### Features/Requirements

- [x] Add password salt to the `Config`
- [x] Set password from profile
- [x] Update password from profile
- [x] Sign in using email/password
- [ ] Sign in using username/password
- [x] Check for unique email
- [x] Check for conflicts when duplicate email during sign in
- [x] Send conflict notification to the admins
- [x] Sign up with just an email (optional)
- [x] Activate accounts
- [x] Bot detection for sign up (optional)
- [x] Forgot/Reset password
- [x] Remember me for custom sign in
- [x] Add descriptions to the forgot/reset pages
- [x] Show email authentication if any in the admin user profile
- [x] Add option in the admin config for email authentication support
- [x] Show a warning and a sign out link when already signed in and trying to access sign in/up pages
- [x] Enforce reCAPTCHA for multiple/wrong attempts in a row
- [ ] Visual fixes to avoid eye bleedings


#### Demo: [custom.gae-init.appspot.com](http://custom.gae-init.appspot.com/)

#### Few things about this _experiment_:

- It's not finished and it might take a while
- There are no repeat passwords fields.. the latest trend says that they are annoying.. :)
- Bunch of things are subject to change and I'm open to any suggestions
- Since the visuals were never the top priority for `gae-init` I don't want to start creating bunch of custom css/js (stuff like transitions, client side validations, etc)
- The server side should be robust and bulletproof


something like this would be nice for dev server:
```python
if config.DEVELOPMENT:
  logging.info('reset link: %s' % flask.url_for('user_reset', token=user_db.token, _external=True))
```
also for the other notifications... would make it a lot easier to test (and no need for setting up sendmail)