Add CSRF protection

This requires that all effectful requests be done via ajax, which I
think is already true. If we wish to support normal forms, that is
possible, but will require slightly more work.

The "light" base template is not quite as light as before. Oh well.
'in' is not what I meant here
Do admin searches as GETs
Clean up dead JS
Merge pull request #247 from eve-val/csrf-protection

Csrf protection (fixes #92)
Add @authenticate decorator for detecting if a user is logged in, and throwing an HTTP 401 if they are not.

Signed-off-by: Tyler O'Meara <Tyler@TylerOMeara.com>
Add ability for applications to have different grant expiration times.

Signed-off-by: Tyler O'Meara <Tyler@TylerOMeara.com>
Add UI support for the new custom application expire times.

Signed-off-by: Tyler O'Meara <Tyler@TylerOMeara.com>
Merge pull request #260 from Acidity/feature/authenticated

Add authenticate decorator for detecting if a user is logged in, and...
Rename expireGrantTime to better reflect what it does.

Signed-off-by: Tyler O'Meara <Tyler@TylerOMeara.com>
Merge pull request #261 from Acidity/feature/customAppExpire

Add ability for applications to have different grant expiration times.
Fix a bug that prevented the deletion of groups.

Signed-off-by: Tyler O'Meara <Tyler@TylerOMeara.com>
Merge pull request #262 from Acidity/feature/fixGroupDelete

Fix bug that prevented the deletion of groups.
Fix authorization under csrf protection

Since the authorization page was posting to window.location, the url was
absolute, and the external-xhr check was triggering.

I cannot believe this is how one parses a URL in javascript.
Pin size of image in authorize button to 32px

This way when script.js retina-ifies it, it stays the proper size.
show as currently in admin area only if the user is an admin
don't show groups and admin areas to non-admins
Merge pull request #269 from eve-val/admin-area

Admin area tweaks (fixes #266)
Merge pull request #268 from eve-val/fix-retina-sizing

Pin size of image in authorize button to 32px
Merge pull request #267 from eve-val/fix-csrf-authorize

Fix authorization under csrf protection