Add minitest-rails-capybara

I'm gonna be loading this on every test, but for now, we only
have feature tests, so that's okay. Once I end up with some unit
tests, I'll end up moving some setup around.
Fix travis config to run all tests.

Turns out `bin/rake test` doesn't run feature tests. So we'll make
sure that Travis runs all the tests instead.
Add a sign in link on the home page.

We have our first test! We want people to be able to log in
from the home page, so we add a link there.
Make an explict task for features.

Apparently this doesn't come with minitest-rails-capybara by default, even
though `bin/rake test:all` will run the features. *shrug*.
Shops can now sign in.

Lots going on here:

First of all, Shops now `have_secure_password`s. I highly prefer this to
Devise. I had a hard time articulating why, until I heard someone say "You
shouldn't outsource core compentencies. User management is a core competency."
I think this person was Ryan Bates, but I'm not 100% sure.

Anyway, we still use `has_secure_password` over rolling our own password
encryption stuff, because it's better to use crypto that's vetted by others.
Plus, I have patches into `has_secure_password`, so in some ways, I wrote it
anyway :wink:.

It requires bcrypt, so we have to add that to our Gemfile. For more on this
topic, see this blog post by @codahale:
http://codahale.com/how-to-safely-store-a-password/

We also hook up a session controller, but we give it better URLs. REST doesn't
mean 'expose your database over the web,' I don't care what Rails tells you.
:wink: It has a destroy method because I know I'm gonna use it later, so I
generated it. Sue me.

I had to introduce flash messages, and so I added in the bootstrap classes,
becuase I will be using bootstrap. Get mad. When you show bootstrap sites to
people who don't have Hacker News accounts, they don't say "omg just like every
other Bootstrap site," they say, "Hot damn, this looks amazing! You're the
best!"

I am not totally happy with the first line of my test saying `shop`, but it's
such a minor detail that I'm not gonna stress it. Suggestions welcome.

Finally, you may wonder why I don't unit test the new features on the User
model. Frankly, trying to test Rails built-in stuff is a waste of time, because
it's already tested by Rails. If I remove the `has_secure_password` line, tests
will break. That's good enough for me. I'm not likely to touch any of this
code ever again, at least, not for a while, and not very often. I'm happy with
the tradeoff here. YMMV.

If this were a feature that relied less on Rails built-in stuff, I would have
this broken into a bunch of commits, where the test is pending, I'd build it up
step by step, yadda, yadda, yadda. But frankly, if I were @dhh, this (or
something like it) would be in Rails itself, and I've written this code so many
times that I'm surprised I haven't bothered to write a generator for it yet.
Well, without the bootstrap stuff. He doesn't like the idea of it being in
core, though, so what are you gonna do. Mostly, write a commit like this in
every application. *shrug*.
Test incorrect password when signing in.
Incorrect email leads to sign in failure.

While this just adds a test, I _did_ comment out the implementation for
the previous test, just to watch it fail. It just so happens that either
causes the same failure. It's nice to have a test for both, though.

These tests are probably overkill for something that's not as important
as signing in. I want to make 100% sure this works all the time, though,
so I'll expend the effort to make it overly tested.
Signing in should take you to your dashboard.

I like giving signed in users their own URL, rather than displaying
some kind of dashboard on the root page. It's way easier to do things like
caching when you give distinct pages their own distinct URLs.
Add a sign out link to the home page.
Add a sign out link to the dashboard.

We'll need one here, too.
Signing out actually signs you out.
New feature complete: authentication.

You can sign in and sign out. Awesome.

See #8 for more details.