shrinkwrap update from 314c8a1

Apparently not passing --force to npm install also allows us to do a
better job of not bundling duplicate npm packages.
Fix 0.8.1 regression in ROOT_URL with path

Fixes #2109.
Fix occurrences of "cd `dirname $0`"

They are not safe for spaces in paths. There might be other places to look for trouble.

I've run the following command to produce this commit: (on OS X, copy-and-pasting the below exactly)

    find . -type f -name '*.sh' -print0  |  # Find all .sh files
        xargs -0 fgrep -H -- '`'         |  # See all places with backticks in them
        fgrep 'cd `dirname $0'           |  # I deemed these problematic (variable assignments are safe)
        cut -d ':' -f 1                  |  # Take the <file> from <file>:<line> produced by "grep -H"
        tr '\n' '\0'                     |  # Also here, spaces can be problematic - always do "xargs -0"!
        xargs -0 -- sed -i '' 's/cd `dirname $0`/cd "`dirname "$0"`"/g'

The significance of adding the two levels of "'s can be verified by running the following in your Terminal:

    $ node -e 'console.log(process.argv.splice(1))' -- `echo 1   2`
    [ '1', '2' ]

    $ node -e 'console.log(process.argv.splice(1))' -- "`echo 1   2`"
    [ '1 2' ]

    $ node -e 'console.log(process.argv.splice(1))' -- "`echo "1   2"`"
    [ '1   2' ]
Typo
Looks like a typo (untested minor change)
Add missing amplify -> jquery dependency

Somehow this worked in 0.7.2 but starting at 0.8.0 amplify has a
ReferenceError.

Fixes #2113.
Set Content-Type header on js and css resources.
Set X-Content-Type-Options in browser-policy-content
nim, glasser comments
Add Content-Type to history
Merge branch 'content-type-headers' into devel
selftest: return null when reading a file that doesn't exist
Stricter validation of connect messages

Previously, you could leave out the "support" field (or claim to not
support the version you were proposing) which would mean your connection
would succeed iff the proposed version is the server's favorite
version. This led to (eg) ObjectiveDDP accidentally writing a client
that stopped working when servers started preferring pre2 over pre1. By
making this a blatant error, DDP client libraries are more likely to
be written in a way that works with version negotiation.

Also, remove the delay in sending connect failure messages, which was
intended to avoid connect storms from clients that are by now 1.5 years
old.

Fixes #2125.
Update commandline.html

Removed deprecated --password command from docs. Added info on new practices.
cleanup HTML
Merge branch 'pr/2117' into devel

Fixes #2117.
Unregister sessions from server when their heartbeats time out.
Fix 0.8.1 regression in ROOT_URL with path

Fixes #2109.
Add credential secret argument to `retrieveCredential` functions.

Fixes #2118.
Unregister sessions from server when their heartbeats time out.

Conflicts:
	History.md