Restored spam prevention

closes #3128
- added spam prevention middleware
- restored tests
Prevent loading setup screen if already setup

Closes #3145
- Prevent navigation to the setup screen if Ghost setup
  has previously been completed.
- Fix templates that were incorrectly using foreach instead of each.
- Add validation for minimum password length.
- Fix up functional tests and split out tests for setup to a separate
  instance of casper because setup requires a new database.
- Add a cleanDatabase task to grunt which resets the database to
  new.
Handle undefined datetime values

Closes #3288
- Check for undefined last_login and created_at values that occur
  on a User model for an invited user.
Hacky FORCE_MIGRATION env var

refs #2600

One day in the future it would be nice to have a CLI for Ghost
In the meantime, lets have an easy way to force migrations to run
This is for development, or dead end situations only
It will at least do a DB backup ;)
Merge pull request #3280 from jaswilli/issue-3145

Prevent loading setup screen if already setup
Merge pull request #3282 from sebgie/issue#3128

Restore spam prevention
Merge pull request #3298 from jaswilli/issue-3288

Handle undefined datetime values
Merge pull request #3296 from ErisDS/force-migrate

Hacky FORCE_MIGRATION env var
Revert "Restore spam prevention"
Merge pull request #3307 from TryGhost/revert-3282-issue#3128

Revert "Restore spam prevention"
Adding and renaming permissions

refs #3283, refs #2739, refs #3096

- Renames permissions which didn't follow bread
- Adds permissions for notifications, mail and tags

Still todo:

- wire up the new permissions where they are needed
- add permissions for roles
New signup screen

See #3082 - This borrows setup screen styles for now
Fade in the setup form
Removing erroneous placeholder text from user profile

Reverting the placeholder that was introduced in #2734 to fix #1623. We should handle this intelligently by automatically interpretting the input and using validation if we can't. The user should not have to know or care about what http is.

Regardless off any of the above, we should not be introducing user-facing text like this without proper consideration. A placeholder of "http://ghost.org" is far more confusing than no placeholder at all. It also looks like a cheap promotional tactic on our part.
Merge pull request #3306 from JohnONolan/fadeinsetup

Fade in the setup form
Merge pull request #3308 from JohnONolan/newsignup

New signup screen
Restored spam prevention

closes #3128
- added spam prevention middleware
- restored tests
Fix tests failing because of spam protection

closes #3128 (now really)
- added express variable disableLoginLimiter
- added disableLoginLimiter to all tests that use Ghost as module and
do authentication
- fixed isSetup not working for status other than active
- removed ‚Ensure a User is Registered‘ test as this is covered by the
new setup test
Merge pull request #3304 from JohnONolan/noplaceholder

Removing erroneous placeholder text from user profile
Merge pull request #3300 from ErisDS/issue-2739

Adding and renaming permissions