Merge pull request #3386 from felixrieseberg/iss3374

Signin: Proper notification if user not found
Merge pull request #3394 from IanMitchell/settings-user-button

Hides <Users button for authors
Merge pull request #3398 from morficus/issue-3396

Fixing resend user invitation
Roles drop down sorted by ID

closes #3391
- Changed sort order to ID instead of name
Merge pull request #3397 from morficus/issue-3392

Removing "full name" auto-popualtion during signup
updated Ember Simple Auth to latest version
Rebind name and password to inputs on signup page

Closes #3410, Ref #3392
- Removed setting name from user email address per issue #3392
Create new user validator to DRY up validators

No issue
- Created NewUserValidator class to DRY up validation of a models name, email, and password
- Changed SignUpValidator to be an instance of NewUserValidator
- Changed SetUpValidator to extend NewUserValidator
Correct meta_title for author pages.

closes #3407
- Output correct meta_title for author pages
- Add test for meta_title for tag and author pages
Merge pull request #3406 from simplabs/update-ember-simple-auth

Updated Ember Simple Auth to latest version
Do not clear password until after leaving signin

Closes #3399
- Provide our own authenticate action handler which does not
  clear the password input.
- Use the Signin route's deactivate hook to clear the password
  property on the controller after the user has transitioned
  away from the signin page.
Merge pull request #3408 from jaswilli/issue-3399

Do not clear password until after leaving signin
Merge pull request #3411 from novaugust/signup-password

Rebind password to password input on signup page
Merge pull request #3412 from novaugust/credentials-validation-convergance

Create new user validator to DRY up validators
Merge pull request #3393 from joeldrapper/sort-roles-dropdown

Fixed role sort order in the invite a new user drop down list
Merge pull request #3413 from halfdan/3407-meta-title

Correct meta_title for author pages.
Hide Access Token

closes #3177
- uses an iFrame to initiate the download to hide the access token

The access token is now hidden in the admin logic. If we would like to
completely hide the token it is possible to remove the access token and
use signed requests instead, but I think the effort isn’t worth the
benefit in this case.
Add XSS prevention

closes #3387
- added placeholder for <script> and <iframe>
- added google-caja sanitizer
- changed title in posts overview to ‚double-stash‘
Add a mixin for saving a subset of a model.

Closes #3403
- Add SelectiveSaveMixin so that a DS.Model can save one or more
  properties at a time while preserving other outstanding changes.
Permissions Improvements

refs #3083, #3096

In order to implement advanced permissions based on roles for specific
actions, we need to know
what role the current context user has and also what action we are
granting permissions for:
- Permissible gets passed the action type
- Effective permissions keeps the user role and eventually passes it to
  permissible
- Fixed spelling
- Still needs tests