Webssh

Fix
* Stop storing plain text password in local storage.

Add
* Added an option `xsrf` for toggling this feature.
* Added more unit tests.

Added
* Support redirecting public plain http requests to https requests.

Adapted
* A http server now listens on '0.0.0.0' by default.

Added
* support https server
* NotFoundHandler for handling 404 requests
* option fbidhttp for blocking public plain http incoming requests
* option tdstream for accepting requests from trusted downstream (if set) only
* option xheader for toggling this feature

Fixed
* reset password to disable password authentication for key authentication
* port number typo

Fix
* Fixed a bug that default port 22 doesn't work for Microsoft Edge.

Improvements
* Use default port 22 when no port value is given.
* Lookup hostname in host keys before connecting to it under reject policy.
* Let tornado parse xheaders.

Improvements
* Support Safari 11.x.