Make the minimal layout be really minimal

Just a title and some content. Saves typing (or forgetting) the UTF-8
charset declaration. The calling template can include <%= css %> etc.
if required.
Merge default and minimal layouts

After the last change, they don't really do anything different anyway.
We retain minimal.html.ep as a link to default.html.ep because some of
the built-in code uses the latter template.
Change ::enqueue_job's return convention to match ->last_send_successful

It's too confusing otherwise, and there are no notable callers yet.
Now one may write "unless (enqueue_job(…)) { … }" quite naturally.
Expect default.css to be in /css

This is somewhat arbitrary, and not very polite (it breaks applications
that depended on the earlier behaviour).
Update to jQuery 1.11.0
Always use /dev/urandom to seed our AES-CTR generator

This was motivated by http://www.2uo.de/myths-about-urandom/, which
explains that the scaremongering about /dev/urandom in the random(4)
manpage on Linux is unjustified and incorrect. Once the entropy pool
has been initialised at startup, both devices are a source of "good"
secure randomness (in fact, the _same_ randomness).

Given this revelation, it would be feasible to do away with our AES-CTR
generator altogether, and just read from /dev/urandom whenever we want
any randomness. But I'm not quite /that/ motivated yet.

We assume that we're running on Linux (or a system whose /dev/urandom
behaves in the same way), and take it for granted that the system has
been properly seeded at startup.

Finally, the annoying pause on startup (especially infuriating with
commands like "hypnotoad --stop ./app") is a thing of the past.
Add M::Command::password to change user passwords
No need to create an #allow_secure route by hand; but it's OK if you do
Make ->dbh work
Remove repeated line
Allow extra files to be specified
Set MOJO_MODE to production by default

It's easier to "export MOJO_MODE=development" in my environment than it
is to suppress debug messages (from e.g. commands) in production.
The "repeated line" was actually needed after a \c

This reverts commit 9847b17c5071a30260a9b9a53ebbd1b1f1917516.
Delete secret data all at once

The premise is that we shouldn't display secret data on error pages (in
development, since the production error pages don't include details). I
now find that rather weak for two reasons: (a) it makes us jump through
hoops to keep the secret data elsewhere (e.g. db_pass), and (b) there
may be other secret data that we don't know about here.

That apart, this commit fixes a mostly harmless bug: if both secrets and
secret were defined in secrets.conf, only the former would be deleted.
Don't delete db_pass from $app->config

It makes us jump through hoops. It caused at least one or two bugs in
the past because in practice, it's rarely set. There are other ways to
deal with it (e.g. ~/.pgpass). So let's retain it until some compelling
reason to remove it appears.
Reconnect to the database if the current handle dies

Earlier, the "db" helper would return a cached DBI handle that was
created on the first call (from a child process). If Postgres was
restarted, all queries would fail afterwards.

Now the "db" method checks if the current "database" (a helper that
stands in for the earlier "db") is still connected, and reconnects
if it isn't. This change should be backwards compatible, but also
restart-friendly.
Assign $self->db to a local variable before reusing

In this case it may not matter much, but this is the right way to avoid
the multiple-ping overhead. (No other such cases were found.)
Use $app->dbh instead of DBI->connect in tests

Random musing: the only reason I've had to call $app->dbh so far is to
connect as the database owner, and here are two more such cases. Yet the
application does not know the name of the database owner. Is that a bug?
Should the owner always be called ${db_user}_admin?
Don't set PrintError for database handles

It's almost never useful to print the error to stdout for a web app, and
in the other cases where it's useful, we can enable it by hand.
Allow ->dbh callers to override database handle attributes

(But there's no good reason to omit pg_enable_utf8, so we always add
that in separately.)