ONEPW to rule them all

Welp, here it is, warts and all. This is the current functional implementation of the onepw protocol.

Highlights:

* removes **most** of the now obsolete code
* new code is not yet well factored
* some of the details are half-baked - email normalization and validation #463
* errors for "future use" are not implemented yet #449 #452
* updated api.md to the new spec (@warner r? on this file?)

I'm not expecting a full review, but if you're interested in getting up to speed the best files to read are `routes/account.js` and `routes/password.js`

For better or worse I'd like to merge this by afternoon Jan. 8