login/out: Close phishing hole

If someone passed a ?done=//phishing.com/site as the param, you'd still
end up being redirected somewhere awful, because of how // is
interpreted in url resolution.

    > u = '//phishing.com/site'
    '//phishing.com/site'
    > url.parse(u).pathname
    '//phishing.com/site'
    > url.resolve('https://www.npmjs.org/login', url.parse(u).pathname)
    'https://phishing.com/site'
    > url.resolveObject('https://www.npmjs.org/login', u).pathname
    '/site'

Resolve the object first against a fully qualified domain name, and then
take the resulting pathname.
patches broken Last Published By link
attempt at clumping latency metrics together
fixes mismatching tags, which wonkified the footer
updates our couch instance from skimdb to aws-west-6.skimdb
a little bit of bypass surgery
only shows arrows when DLs significantly (in|de)crease
updates ES for empty dlScore and stars values
adds hostname to www stamp
Made dev-mode metrics work.

Moved the prod metrics config up in the file so the admin config can override it.
Added the development metrics config to the dev runner.
speeds up the email lookup for password reset
0.5.4