Add authorization to person and organization apps
Update copy for new auth pages

Also includes a change to the admin app which includes the name of the
user sending the invite in the email.
Fix legacy upgrade with missing instance

If the user is trying to upgrade their account and for some reason the
instance has been deleted in the meantime then we simply redirect to the
main listing of instances.
Add hashes to JS and CSS files for cache invalidation

Only do it for JS on production as requirejs makes this hard on
development and it shouldn't really be needed there either.

When I say it makes it hard I mean that because it's requesting lots of
files and then using the path of those files as the module name putting
in place the code to resolve this is both painfully manual and hence
error prone and also problematic because of the way require handles
fetching. Given cache busting is only really an issue with production
deployment it's not worth the pain.

For #554
initial token based api authentication

still needs to check if the permission for the token holder is valid for
the operation
basic api key management

page on hosting app to request and remove an api key.
use roles for api auth

and correctly handle the fact that legacy users do not have roles or
permissions