Shops can now sign in.

Lots going on here:

First of all, Shops now `have_secure_password`s. I highly prefer this to
Devise. I had a hard time articulating why, until I heard someone say "You
shouldn't outsource core compentencies. User management is a core competency."
I think this person was Ryan Bates, but I'm not 100% sure.

Anyway, we still use `has_secure_password` over rolling our own password
encryption stuff, because it's better to use crypto that's vetted by others.
Plus, I have patches into `has_secure_password`, so in some ways, I wrote it
anyway :wink:.

It requires bcrypt, so we have to add that to our Gemfile. For more on this
topic, see this blog post by @codahale:
http://codahale.com/how-to-safely-store-a-password/

We also hook up a session controller, but we give it better URLs. REST doesn't
mean 'expose your database over the web,' I don't care what Rails tells you.
:wink: It has a destroy method because I know I'm gonna use it later, so I
generated it. Sue me.

I had to introduce flash messages, and so I added in the bootstrap classes,
becuase I will be using bootstrap. Get mad. When you show bootstrap sites to
people who don't have Hacker News accounts, they don't say "omg just like every
other Bootstrap site," they say, "Hot damn, this looks amazing! You're the
best!"

I am not totally happy with the first line of my test saying `shop`, but it's
such a minor detail that I'm not gonna stress it. Suggestions welcome.

Finally, you may wonder why I don't unit test the new features on the User
model. Frankly, trying to test Rails built-in stuff is a waste of time, because
it's already tested by Rails. If I remove the `has_secure_password` line, tests
will break. That's good enough for me. I'm not likely to touch any of this
code ever again, at least, not for a while, and not very often. I'm happy with
the tradeoff here. YMMV.

If this were a feature that relied less on Rails built-in stuff, I would have
this broken into a bunch of commits, where the test is pending, I'd build it up
step by step, yadda, yadda, yadda. But frankly, if I were @dhh, this (or
something like it) would be in Rails itself, and I've written this code so many
times that I'm surprised I haven't bothered to write a generator for it yet.
Well, without the bootstrap stuff. He doesn't like the idea of it being in
core, though, so what are you gonna do. Mostly, write a commit like this in
every application. *shrug*.