fix(l10n): ensure that supported languages are a subset of the default supported languages
fix(csp): allow image sources from gravatar
Merge pull request #1473 from mozilla/csp-gravatar

fix(csp): allow image sources from gravatar
Remove npm spinner on Travis
styling links in the success messages
Merge pull request #1484 from pdehaan/travis-no-spin

Remove npm spinner on Travis
Merge pull request #1487 from pdehaan/issue-1486

styling links in the success messages

Looks great, thanks @pdehaan!
feat(oauth): message to native flows
settings(UI): add legal links to settings page
refactor(client): Prepare for multiple channels.

* Channels are now ephemeral, no more storing channels on Session.
* Create a BaseChannel which is the root of all other Channels.
* Extract the current OAuth redirect code into its own channel named RedirectChannel.

* Use the channel's `send` interface to determine whether it supports OAuth auto-verification.
* Upon OAuth completion, display a spinner on the available submit button.
* Upon OAuth completion, if no response is received from the channel within 10 seconds, display an error message.

* Mock in some OAuth server interactions to allow for more unit test coverage.
* Remove the @vladikoff's FxWebChannel for now to simplify review. I will add this in a separate PR.
Merge pull request #1435 from mozilla/validate-supported-langs-config

fix(l10n): ensure that supported languages are a subset of the default s...
Rip out the notion of "should_auto_complete_after_email_verification" and auto-completing. It's not actually needed anywhere except the IFRAME channel, which isn't even part of this PR. Thanks @vladikoff!
Merge pull request #1437 from mozilla/prepare-for-multiple-oauth-channels

Prepare for multiple channels
chore(tests): Set Functional test timeout to 30 seconds. Adds directDomains and skipSslDomains for the SauceLabs tunnel.
Merge pull request #1501 from vladikoff/directDomains

chore(tests): Set Functional test timeout to 30 seconds. Adds directDoma...
fix(client): Show the /force_auth error message on startup, if one exists.

* `.error` elements are invisible by default. Add the `.visible` class.

fixes #1504
Merge pull request #1498 from mozilla/issue-1371

settings(UI): add legal links to settings page

Looks great, even on small screens. Thanks @johngruen
Merge pull request #1505 from mozilla/issue-1504-invisible-error-on-force-auth

fix(client): Show the /force_auth error message on startup, if one exists.
tests(travis): disable shrinkwrap validation
fix(deps): update express and request dependencies to patched versions