Pull vows via https, not git protocol

hardik in IRC had a ton of trouble installing Persona because of this. For some
reason he wasn't able to clone over git://, but https works just fine.

This should also be marginally faster since we don't have to clone an entire
repo.
Merge pull request #4061 from gene1wood/dev

Adding setup instructions for RHEL and RHEL derivatives
Merge pull request #4062 from mozilla/deps

Pull vows via https, not git protocol
bumped client-sessions and hood
allow loggedInUser: false

fixes #4069
Check each component of the relay frame origin separately

The current check against the origin we craft will succeed in the
case of a URL which merely starts with the same text as the
crafted origin.

An example is a URL like "http://example.com@hostile.com" which
would match an origin like "http://example.com".

https://bugzilla.mozilla.org/show_bug.cgi?id=878485
Require a password-level authentication when confirming an email

Since a successful email confirmation leads to an authentication
level of "password", we should ensure that the user is already
authenticated at that level before going ahead with it.

https://bugzilla.mozilla.org/show_bug.cgi?id=908716
Changed timeout to 2 hours
Merge pull request #4091 from p0ffsrule/dev

Changed timeout to 2 hours

Fixes #3333
Merge pull request #4063 from seanmonstar/sessions-up

bumped client-sessions and hood
fix for cookies 0.3.8 not in lockdown.json
Merge pull request #4093 from seanmonstar/cookies

fix for cookies 0.3.8 not in lockdown.json
Fix for issue #3270: The xhr_delay error message doesn't specify which WSAPI call is timing out
Merge pull request #4094 from khuevu/dev

Fixes #3270: The xhr_delay error message doesn't specify which W...
Fix automation-tests for 797894f "Require a password-level authentication when confirming an email"
set secureProxy=true when running behind an ssl proxy
Merge pull request #4101 from jrgm/auto-test-fix-for-797894f

Fix automation-tests for 797894f "Require a password-level authentication when confirming an email"
Merge pull request #4071 from seanmonstar/allow-false

allow loggedInUser: false
test for wsapi client-sessions using ssl proxy
Fix #3866 - Use RP branding on login popup in main site.