Support for insecure POP3 (without SSL)

Ideally it would be a menu selection to select POP3, POP3S, and potentially other future protocols like IMAP if desired, but I didn't want to deal with data migration at this point.  And then I was going to have a checkbox for "Secure" (on by default, obviously), but that was very hard to word as to how it was different given everything else referred to pop3s and I couldn't change that either.  So I settled on a preference:

pop3s_polling_insecure: "Poll using plain text POP3 without SSL"

Off by default.

This makes it very clear that as to what turning on that checkbox will be, and by calling it "insecure" makes sure people will think twice before turning it on.

I have not attempted to do any of the translations of the preference, I'm ot sure how you handle that.
Bugfix: Mailing list mode disables PM emails

Emailing a PM uses the user_posted event/format, but Mailing List Mode disables emails with this format.

We work around this by temporarily using "postedprivate", and then reverting back to "posted" efter the Mailing List Mode check.
Honor email_always even if notification has been read

Even if the notification has been read, send it by email if user has enabled email_always
Added test to ensure email is sent to users with email_always set even if the notification has been read
Add custom embed_by_username feature

Feature to allow each imported post to be created using a different discourse
username. A possible use case of this is a multi-author blog where discourse
is being used to track comments. This feature allows authors to receive
updates when someone leaves a comment on one of their articles because each of
the imported posts can be created using the discourse username of the author.
Corrected typo, corrected accidental tab, removed unnecessary database rollback

Corrected it "do send" to it "does send"
Removed unnecessary user.update_column (rollback happens automatically)
Replaced Tab with spaces.
Allow all /my URLs

Previously, URLs like /my/activity/posts were denied. This change allows those URLs.
SECURITY: fix XSS
HACK: disable undo/redo editor functionality

TODO in a few weeks, rip out all code.
collapse tests to improve perf of suite
BUGFIX: do not strip spaces from raw_hash of posts
BUGFIX: no network could mean no posts save.
Fix typo in XSS test
Merge pull request #2447 from techAPJ/typo-patch-1

Fix typo in XSS test
Merge pull request #2420 from peternlewis/mailing_list_mode_disables_private_message_emails

Bugfix: Mailing list mode disables PM emails
Revert "Bugfix: Mailing list mode disables PM emails"

This reverts commit 6a2dde641716209e89fa7cff75c159255abdf4bd.
Let Plugin-Outlet Render inner template data

 - allows passing of template data to the plugin-outlet to be rendered if no plugin is using that slot
 - acts as a fallback when no plugin is found
 - allows wrapping of existing features inside a plugin-outlet that then plugins can overwrite with their own behaviour
 - backwards compatible
 - uses invisible emberviews (as Ember.Component does)
 - the template has full-access to the controller and view, should be totally transparent
Merge branch 'add_custom_embed_by_username' of github.com:justinleveck/discourse into justinleveck-add_custom_embed_by_username

Conflicts:
	config/site_settings.yml
Merge branch 'justinleveck-add_custom_embed_by_username'
Don't disable the composer's submit button. Let it be clicked to cause validation error messages to show.