Initial Admin Architecture

This admin architecture sets up the different admin
tab views (eg, user management tag config, etc).  It
includes admin endpoints and routing policies to ensure
the right security.

Right now you can:
- View/list users
- Filter users by name
- Look at pages of users (paginated results)
- enable and disable user accounts
- make a user an admin or revoke admin status

This is the start of work on #114.
Update comment to be correct

Reflect what the code is actually doing
Pass alerts to view to render

In the case that a user's account is disabled, and we're
not using normal login dialogs (eg, SSPI), be sure to pass
the message through.

Rename main/find to main/index to match the view.
Update routes to match this target.

Create a data variable to be passed to the template, so
more dynamic data can be passed.

Add a `signin` flag to login.json to check if you even
want to have a sign in link on your website.

Pass req.alert to the view via the data variable.

Update sspi to pass errors separately from invalid users;
invalid users should still render the page but with the
respective warning.
Whitespace commit

Don't use tabs.  They're ugly.
Remove commented out code

No longer necessary; was there for testing SSPI but that
testing is now done.
Search by both name and username

Ironed out the problems with searching by name/username

Use the updated `bytea` branch of sails-postgresql.
Be sure to update your npm modules (especially pg).

Run `npm install` in sails-postgres before proceeding
Optimize server fetch

Small optimization -- only fetch from the server
when the content of the field actually changes.  If you
press a button that doesn't change things (like SHIFT or
CMD or ...) don't do anything.
Add unlock and reset password

Add to the admin panel the ability to unlock a user that
has exceeded their allowable password attempts. Added
an admin function in AdminController.

Add to the admin panel the ability to reset a user's
password.  Uses a new `resetPassword` endpoint on the
UserController (/api/user/resetPassword).  If the
user is not an admin, it will reset their password.
Otherwise, it will use an option id parameter posted
to the API which will identify which user to change
the password.

Added the passwordLockout option to auth.ex.js
Enable user lockouts

Users will now be locked out if their password attempts
exceed the configuration option in auth.js

Different messages will be shown to users depending on whether
they get their password right or wrong after the lockout.

Added a new test case to user.test.js to make sure the account
is being correctly locked out.
Move all tests to chai.assert

Use the chai assert library instead.  It is nicer and has
a lot more options/tests
Add a reset password test

Verify that the password correctly gets reset
Don't show password for non-local login

If no local logins are allowed, there's no reason to show
the password button options.  This is the case where only
OAuth is used, or SSPI.
Profile a link to navigate to profiles

For users, let the admin navigate to their profile.
From there, they should be able to change info (if they
want to, eventually, not yet implemented)
Enable project editing by admins

Allow admins to edit projects, just as if they were an
owner.  Admins can now add/delete tags, change the
project title and description, and update the project
owners.
Make tasks editable by admin

Allow admins to get to the task edit/close actions
Fix for logged out users

need an empty associative array if the user is not
logged in.
Enforce rules for editing tasks/projects

Must be an owner or an admin.  Enforce those rules
using a new `ownerOrAdmin` policy.  Before, it looked
like anyone could change/remove tasks/projects.  Whoops.
Make profiles editable by admins

Massive changes to make profiles editable by
administrators
- Allow /profile/:id/edit URLs
- pass userId into most of the activities so that
  it isn't just assumed that it the logged in user
- Update policies to only allow users or admins
  to change user profiles
- Warn admins that they are editing someone else's
  profile
- Update ownerOrAdmin to not abort when dealing
  with objects that aren't tasks or projects
Fix bug in not changing location/agency

There was a bug where the location wouldn't change despite selecting
a new location. This only occurred after you selected a location
for the first time.  Force the delete for the existing tag, and
then store the new tag.

Addresses https://github.com/USStateDept/midas-crowdwork/issues/28
Always use latest location/agency tags

In the rare event that multiple tags are stored, always
use the latest stored value

Addresses https://github.com/USStateDept/midas-crowdwork/issues/28