Using superagent instead of XHR direct

it's not as nice but means we can swap things out in Node.js for some upcoming work in Hoist

This hasn't been fully tested yet, so don't commit urgently. Need to test

~~data: get, post, delete~~
~~file: post, get~~
~~auth: post,login,status, invite~~
~~buckets~~
~~notify~~
~~connectors~~
~~social auth~~