Post settings published_at date improvements & fixes

closes #1866, fixes #2067, fixes #2068

- Upgrade client side moment to 2.4.0 to match the server side script.
- Add a guard to pub date to fix #2067
- Add new format to close #1866
Merge pull request #2077 from ErisDS/date-fixes

Post settings published_at date improvements & fixes
Improve password reset token

no issue
- added check that a combination of email + expires is rejected after
10 attempts
- changed comparison to time independent method

Thanks to @chiiph for reporting this issue!
Merge pull request #2082 from sebgie/fix-reset-token
Version bump for 0.4.1
Merge branch '0.4-maintenance'
Spit & Polish
Override border on login input:focus

Fixes #2088
Adding a link to config docs in config.example.js

closes #1997
Load Apps Sandboxed

- Based on suggestions from hswolff loading with a Module class approach
- Loads relative modules in child sandboxes
Merge pull request #2091 from jgable/sandboxApps

Load Apps Sandboxed
Fixing App unit test on Windows

- switched test from exact string to regex to match both types of paths
Replace underscore with lodash.
Merge pull request #1536 from jdalton/lodash
We’re not really in alpha any more