Tighten up the identity and auth interaction

Handle errors, ready notification, cancellations and cleanups.
Test the events emitted by the auth controller
Move session service back to h module

This is in preparation for using the so-called "Goldilocks API" of
Persona where we manage the session ourselves.
tighten
Switch to BrowserID "Goldilocks" API

Rather than support the fiddly matrix of possiblities when a user
may not have a session with the application but has a session with
the identity provider, borrow the newer "Goldilocks" API design from
upstream where the application is responsible for its own session
and the BrowserId implementation is less stateful.
Resolve the Store config before the AppController