removes unused Application._sendToAllUsers method
changes Application to fire ChallengeExpired with the id instead of the challenge
sends /challenge/expired from User when a challenge expires

the aim is to get all send()s out of Application (the only place that
still has them except for User) so that only the User knows about
sending stuff to the client.
removes User.disconnect from replace() - there's no need to disconnect them,
as logging out pretty much re-initialises everything on the client anyway
sets _currentChallenge in User._createChallenge