Server can overwrite client secrets

In `core.js`, in `crypton.authorize` each property from the response body (parsed as JSON) is copied into the Account object. A server can therefore send a response body containing the JSON representation of properties named `passphrase`, `keypairCiphertext`, `containerNameHmacKeyCiphertext`, and `hmacKeyCiphertext`.
This causes the client's Account object to have those properties overwritten to contain values provided by the server.