fix(avatars): load profile image on settings and sign in pages if available

 This refactor changes a number of things:
    * fix avatar background (fixes #1722)
    * loads profile images on settings and sign in account chooser (fixes #1727)
    * introduces User and Account models
    * imports old Session based sessions into User
    * handles direct link to settings page from RPs for a specified account (fixes #1686)
    * redirects unverified accounts that visit /settings (fixes #1716)
    * introduces a way to pass ephemeral data between views
    * removes unused avatar-change-via-URL resources/tests (fixes #1544, fixes #1618)
Is the only thing this does is clear OAuth info? I'm scheming. I think we may be able to notify the broker and have the broker do this.