introducing django-oauth-toolkit and public client refresh tokens

Available backends:

* django-oauth-toolkit (DOT)
* django-oauth2-provider (DOP)

* Use provided client ID to select backend for
  * AccessToken requests
  * third party auth-token exchange
* Create adapters to isolate library-dependent functionality
* Handle django-oauth-toolkit tokens in edX DRF authenticator class

MA-1998
MA-2000

MA-1998 Install and configure django_oauth_toolkit to coexist with
existing oauth libraries.

Release Candidate rc/2016-03-29

fixing typo in template

Add check for multiple page tags

Upgrade xblock-lti-consumer to 1.0.4 to pull in bug fixes

Fix issues with Underscore in the asset pipeline

Fix to remove mulitple page tags on mako templates

Consolidated page tags in instructor analytics template.

FEDX-121

The previous approach for handling NPM assets was
to symlink them into the static directory. This appeared
to cause trouble with the asset pipeline where the files
in question were not installed and then old versions were
picked up instead.

This change instead copies NPM libraries to a new
static directory so that the pipeline can consume them
as with any other file. This new directory is added to
.gitignore so that the files don't get accidentally
checked in.

Setting request timeouts for edx notes.

TNL-2444

safe template

XSS Bug Bash

Merge pull request #11827 from edx/waheed/ecom-2947-support-entire-password-reset-flow-in-logistration

Fixed the other half of forgot password flow accourding to logistration.

ECOM-2947

Remove unused empty file

Added safe templating to instructor_analytics.html.

Make CDNifying of course over image URLs only happen for relative URLs.

Hotfix 2016-03-24

Update translations (autogenerated message)

[hotfix] Redirecting sidebar verification link to new checkout basket.

This appears to actually be in UTC (not in the django TZ default).

Updated edx-proctoring requirement to 0.12.15

. And change the verification link in the sidebar to redirect to new basket if the EcommerceService is enabled.

Make CMS 500 template safe by default

Make CMS 404 template safe by default

Sstudent/safe video template

making the welcome_back template safe