improved error message on suspected attack

now includes IP address of attacker for scare tactics
concluded password change API testing

resolves #9
making code mangleable by minifier
extracted ProductDetailsController
mangling client JS

resolves #20