Refactor Palette/PaletteSpec models

* Move generation of palette (from image_url) out of PaletteSet
  and into Palette
  * Palette's color attribute should now be read-only
    (and only set upon initialization)
  * Validations on color attribute are no longer needed
  * Trust ImageMagick output to format colors correctly (ie with the '#'
    at the start of each color) -- remove format_colors method
* Update specs to reflect this change
Fixed navbar for signed-in user
Put custom user routes in devise scope
Add authenticity token to Favorites form

* Add as hidden field via token_tag helper
* Required to make Favorite button work in browser
  * Cukes passed w/o it because in config/environments/test.rb,
    config.action_controller.allow_forgery_protection is set to
    false by default (disables CSRF protection in test mode)