Improve formatting of login error messages
Don't allow fetch_person to throw errors

This ensures that missing optional fields don't prevent a Person from being
returned.
Make login_user a member of LoginProvider

However, still export it from the module for testing purposes.
Only export necessary symbols from the 'security/views' module
Ensure that a user's missing external_id is saved for subsequent use
Only attempt to store a post-login redirect if it was explicitly requested

Otherwise, the post-login redirect will be to the internally-set default
location ("/sessions").

This simplifies the OAuth workflow in the typical case.
Switch Google login from OpenID to OAuth2

Google has deprecated their OpenID service and will eventially
discontinue providing it.

Closes #33.
Merge branch 'login_improvements'

* login_improvements:
  Switch Google login from OpenID to OAuth2
  Only attempt to store a post-login redirect if it was explicitly requested
  Ensure that a user's missing external_id is saved for subsequent use
  Only export necessary symbols from the 'security/views' module
  Make login_user a member of LoginProvider
  Don't allow fetch_person to throw errors
  Improve formatting of login error messages
Explicitly specify returned user fields in Google login
Merge branch 'login_improvements'

* login_improvements:
  Explicitly specify returned user fields in Google login
Add a new default JSON encoder that can process BSON objects
Add 'to_son' method to model classes
Change Role to GroupRole, and add UserRole

This also auto-creates a UserRole when 'user_role' is accessed, if one
doesn't already exist.

The alternative to storing both roles in the same list is to make
'group_roles' and 'user_roles' a real field and 'roles' return an
ImmutableList. It is likely that 'roles' will be read more often
than 'group_roles', so it's probably more optimal to avoid
constructing a new ImmutableList each time 'roles' would be accessed.
WIP: APIv2

Closes #41.