Encrypt account service configuration and OAuth secrets stored in the
database.

"Oauth" is renamed to "OAuth".  "Oauth" is kept as an alias for
backwards compatibility.

README.md contains a sample description of how to generate and use the
oauthSecretKey, which might be incorporated into the wiki
documentation page.
oauth-encryption code review items

Have `OAuthEncryption.open` throw "decryption unsuccessful" on any
error to avoid allowing an attacker to break the encryption key by
observing the result of sending manipulated ciphertexts.

Add oauth-encryption and the oauthSecretKey config options to the docs
page.

Update history.

More documentation on functions.

Use `OAuth.sealSecret(...)` instead of `{seal: ...}`.

Rename OAuth._openSecret(s) to OAuth.openSecret(s).

In the readme describing how to generate a key, just use Node instead
of going through the hassle of creating a Meteor application.

Have the `oauth` package weakly depend on `oauth-encryption` for when
it's being used without accounts.

Add tips on using oauth-encryption without accounts to the readme.
Add example for encrypting existing user tokens to the oauth-encryption readme.

Replace the `Meteor._insecureExceptions` flag with
`Meteor._printDecryptionFailure` to more closely match livedata's
`Meteor._printSentDDP` and `Meteor._printReceivedDDP`.  This also has
the advantage of not changing the behavior of the `open` function when
additional debugging is needed in development.
Make Blaze refuse to render javascript: URLs.

Call UI._allowJavascriptUrls() to enable them again. In the future, we
should have a per-element way to enable this, not a global
configuration, and maybe someday even a similar feature for other
policies (like enabling or disabling inline event handlers).
Merge branch 'oauth-encryption' of https://github.com/awwx/meteor into awwx-oauth-encryption

Conflicts:
	packages/facebook/facebook_client.js
	packages/github/github_client.js
	packages/google/google_client.js
	packages/meetup/meetup_client.js
	packages/meteor-developer/meteor_developer_client.js
	packages/oauth/pending_credentials.js
	packages/twitter/twitter_client.js
	packages/weibo/weibo_client.js
Reindent `OAuthEncryption.isSealed`
Check `authTag` in `isSealed`
Add some curly braces
Check `auth_ok` before parsing decrypted ciphertext
Remove unnecessary DOM update in test.
Only update URL attribute values after checking protocol.
Avoid relying on HTMLAnchorElement.protocol; browser support not clear.

Also avoid url.format, since we don't actually need server-side URL
normalization yet and it's not clear what, if any, normalization
url.format does.
Add History entry for javascript: hrefs
Merge branch 'href-attr-handler' into devel
Move userId out of AAD and into plaintext.

We want to maintain compatibility with the node crypto module, which
doesn't currently have an interface for specifying AAD.
Remove Meteor._printDecryptionFailures.

We can add it back in if users want it; for now it makes me nervous.
Add a couple more oauth encryption tests
Merge remote-tracking branch 'origin/devel' into awwx-oauth-encryption

Conflicts:
	History.md
	packages/facebook/facebook_client.js
	packages/github/github_client.js
	packages/google/google_client.js
	packages/meetup/meetup_client.js
	packages/meteor-developer/meteor_developer_client.js
	packages/twitter/twitter_client.js
	packages/weibo/weibo_client.js
Add OAuth token encryption to pending token collections
Oauth -> OAuth