Make Blaze refuse to render javascript: URLs.

Call UI._allowJavascriptUrls() to enable them again. In the future, we
should have a per-element way to enable this, not a global
configuration, and maybe someday even a similar feature for other
policies (like enabling or disabling inline event handlers).
Revert "Meteor.loginWith<External> now waits for config"

This reverts commit 76ded8feb27a0d83f0b1857aa07e3a7c3d00c7d3.
Improve error message for pre-config login

Addresses #2048.

An earlier attempt (to wait for the config to load) ran into popup
blockers.

It would be nice to load the config statically with something like
Arunoda's fast-render. That said, even that's not good enough to allow
OAuth logins that bypass the popup blocker that aren't a result of a
user action, and for user actions it's easy enough to gate your login
button on `Accounts.loginServicesConfigured()`.

Longer term solutions include non-popup methods of OAuth login (see
Issue #438).
Fix open redirector in oauth1 login flow.

Clients are no longer allowed to specify callback URLs.
Update docs and examples
Update banner text
Update notices
Update docs and examples to 0.8.0.1
Add 0.7.2.1 to notices
Merge branch 'release-0.8.0.1'

Conflicts:
	docs/.meteor/release
	docs/lib/release-override.js
	examples/clock/.meteor/release
	examples/leaderboard/.meteor/release
	examples/parties/.meteor/release
	examples/todos/.meteor/release
	examples/wordplay/.meteor/release
Merge branch 'master' into devel

Conflicts:
	History.md
	packages/oauth1/oauth1_server.js
Stop node tar from including proprietary tags

The linux tar whinges about unrecognised headers (though newer versions
include an option to not warn).
By building tar files without proprietary, we will be able to use
files.createTarball() in more places.
For example, undo commits 1c36bbaa79d76efd4817c5e1faeeed0c9429e0a3 and
1e2a40ef2bab5134ff2d6d813cd3ea5a0822a748
Document Accounts.loginServicesConfigured

Fixes #1051.  See also #2048.
Warn about unready publications to spiderable docs

Fixes #1149.
Update Twitter configuration instructions again

Also, advise turning on "Sign in with Twitter", which means that users
won't get an authorization question every time they log in.

Fixes #1164.
Remove unnecessary DOM update in test.
Only update URL attribute values after checking protocol.
Avoid relying on HTMLAnchorElement.protocol; browser support not clear.

Also avoid url.format, since we don't actually need server-side URL
normalization yet and it's not clear what, if any, normalization
url.format does.
Add History entry for javascript: hrefs
Merge branch 'href-attr-handler' into devel