AppProxy with permissions checks and app context

Ref #2059

- Refactor appProxy into class that is instantiated per App
- Check for permissions before doing proxied filter/helper calls
- Add all currently existing api methods, let api check for permissions
- Basic unit tests for filter and helper register/deregister
- Adjusted proxy api method existence unit tests
Add include parameter for posts API

closes #2609
- added include parameter to api.posts.*
- changed toJSON to omit objects that are not included
- added include parameter to admin
- added include parameter to frontend.js
- updated tests
- removed duplicate code from posts model

**Known Issue:** It is not possible to attach a tag using an ID.
Merge pull request #2646 from sebgie/issue#2609

Add include parameter for posts API
Additional objects

closes #2620
- moved aspect -> filters
- updated tests
- fixed inconsistency in pagination object
Support for urlSSL config option and forceAdminSSL 403 response

closes #1838
- adding `forceAdminSSL: {redirect: true/false}` option to allow 403 over non-SSL rather than redirect
- adding `urlSSL` option to specify SSL variant of `url`
- using `urlSSL` when redirecting to SSL (forceAdminSSL), if specified
- dynamically patching `.url` property for view engine templates to use SSL variant over HTTPS connections (pass `.secure` property as view engine data)
- using `urlSSL` in a "reset password" email, if specified
- adding unit tests to test `forceAdminSSL` and `urlSSL` options
- created a unit test utility function to dynamically fork a new instance of Ghost during the test, with different configuration options
Merge pull request #2631 from jgable/appProxyContext

AppProxy with permissions checks and app context
Merge pull request #2238 from gimelfarb/fix-1838-admin-ssl

Support for urlSSL config option and forceAdminSSL 403 response
Merge pull request #2652 from sebgie/issue#2620

Additional objects
Converting aspect -> filters for tag pages

fixes the build

- PR #2238 added an extra reference to aspect which wasn't fixed by #2652, this resolves that
Removed 2 sec pause

refs #2660
- removed timeout from routes tests (since Ghost is used as module it
is restarted before logging in)
- Casper.js does only one login and the existing waits are executed
after testing login limiters
- gain: 8 sec :-/
Merge pull request #2662 from sebgie/issue#2660

Removed 2 sec pause