User edit, add & destroy perms restricted by role

closes #3096, closes #3378, refs #3100

- user.permissible updated to reflect proper permissions
- small amount of API refactoring to handle extra cases
- extensive integration testing
Merge pull request #3405 from sebgie/issue#3387

Add XSS prevention
Merge pull request #3422 from sebgie/issue#3177

Hide Access Token
Merge pull request #3423 from jaswilli/issue-3403

Add a mixin for saving a subset of a model.
Merge pull request #3395 from ErisDS/issue-3096

User Permissions: Edit, Add, Destroy & Role management
Change refresh token expiry

no issue
- acquiring a new access token using a refresh token sets the
expiration time of the refresh token to now + 24 hrs.
- moved all occurrences of ONE_HOUR, ONE_DAY and ONE_YEAR to
`core/server/utils`
Change casperjs helper used to get RSS page content.

closes #3431
- change feed_test.js to call casperjs getHTML() instead of
  getPageContent(), because the latter now strips markup

Alternative fix would be to use .page.frameContent directly
instead of using a casperjs wrapper.

Change runs cleanly on Travis (old casperjs tag) and locally
in the Ghost-Vagrant setup with both the old casperjs tag
and the current HEAD SHA (29bbd03f7cdc9fc1e70f0fe1400635dd7d3537ad)
Reset/Signin while signed in

no issue
- added redirect and notification to reset route
- added notification to signup route
Clean up
Finished first pass on new navbar
Slightly smaller user profile image for nav dropdown
First pass on global nav mobile styles
Preserve order of tags as entered by the user.

Closes #3133
- Implement an ordered set for the tags property of the tag
  input controller.  Set order is by order added to the post.
Merge pull request #3434 from gleneivey/3431-run-with-latest-casperjs

Change casperjs helper used to get RSS page content.
Merge pull request #3430 from sebgie/refresh-token-expiry

Change refresh token expiry
Merge pull request #3435 from jaswilli/issue-3133

Preserve order of tags as entered by the user.
Error when inviting users

fixes #3433
- passing only the role ID when creating a user
- uncommenting test cases
Merge pull request #3437 from morficus/issue-3433

Error when inviting users
Implementing HTML emails

closes #3082
- no more in-line HTML strings
- adding files for "welcome", "reset password", and "invite user" emails
- added mail.generateContent() to create HTML and plain-text email content
- refactored methods that trigger emails to send both HTML and plain-text emails
Removing "author" role-label

closes #3427
- adding conditional statement to now display users with role "author"