Account functionality extended, API authentication implemented

- Can now add a second email address to your account and delete one of 
your email addresses
- Reset password now works
- Resetting the password of an account without a password set will set 
one
- Email templates overhauled
- Login tokens limited to close previously devastating ($800 database 
bill) security hole
- Login with REST API now works
- Once logged in, authentication of API calls with token works
- Creatures can now be fetched using the API

app/imports/api/sharing/sharingPermissions.js

@@ -4,7 +4,7 @@ import fetchDocByRef from '/imports/api/parenting/fetchDocByRef.js';
 function assertIdValid(userId){
   if (!userId || typeof userId !== 'string'){
     throw new Meteor.Error('Permission denied',
-      'No user ID given for edit permission check');
+      'No user ID. Are you logged in?');
   }
 }