upgrade Aspen to 0.36

fixes #2984 and #3004
don't consider suspicious users as ANON (fixes #2786)
Merge pull request #3019 from gratipay/aspen-0.36

Upgrade Aspen to 0.36
Merge pull request #3021 from gratipay/suspicious-not-anon

Allow suspicious users to log in
fix basic auth

fixes https://app.getsentry.com/gratipay/gratipay-com/group/45029121/
fix tests
show user ID on account page and update API doc in README