fix(avatars): load profile image on settings and sign in pages if available

 This refactor changes a number of things:
    * fix avatar background (fixes #1722)
    * loads profile images on settings and sign in account chooser (fixes #1727)
    * introduces User and Account models
    * imports old Session based sessions into User
    * handles direct link to settings page from RPs for a specified account (fixes #1686)
    * redirects unverified accounts that visit /settings (fixes #1716)
    * introduces a way to pass ephemeral data between views
    * removes unused avatar-change-via-URL resources/tests (fixes #1544, fixes #1618)
`self.currentAccount()` calls `this.user.getCurrentAccount()` which calls `this.createAccount()` with account data fetched from `_getCurrentAccount()`, unless `_getCurrentAccount()` returns null.  `_getCurrentAccount` calls `_getAccount` which could return null, meaning `self.currentAccount()` could return null and this dereference explodes. Anything to worry about?