Remove dead client side cnameframe parameter.

Thanks to /u/largenocream for reporting this.
multis: Add missing VModhash to PUT_multi_description.

Thanks to /u/largenocream for reporting this.
password reset: Validate token before affecting user session.

Thanks to /u/largenocream for reporting this.
Blanket X-Frame-Options: SAMEORIGIN policy.

Thanks to /u/saurabh_nemade for bringing a content extraction redressing
technique to our attention.
toolbar: Match reddit subdomains due to framing restrictions.
toolbar: Add 'allow-same-origin' to fix AJAX within frames.
toolbar: Fix frame sizing with comments pane open.

Since iframes are "replaced elements" they don't auto fill space when a
left and right absolute position is specified. The hacky solution is to
add a container <div> which we can size appropriately and then fill with
the <iframe>.
Use HTTPS for password reset emails.
Allow media embed content to be framed, as intended.
StripeController: give 404 response to charge notice with no buyer.
StripeController: create customer then set subscription.

`create_customer` does address verification and we choose not
to make any charges if the verifications fail. We need to wait
until after that verification before creating a subscription.
StripeController: pass the form to cancel_subscription.
Fix typo in promo email.
accountid_from_paypalsubscription: find spam users.
all_gold_users: retrieve spam users.
ipn: clean up aborts.
Don't link subreddit creator if they're not a moderator.
Use correct cache for modmail permalinks.
Daily gold goal: store in cassandra
JSON: add link_author to out-of-context comments