* course roots live in roots/{url_name}.xml
   - one is linked from course.xml

* policies live in policies/url_name.json
  - loaded based on course url_name

* Updated to pass policy through into xml parsing, so it takes effect
  before descriptor constructors are called.

* Update toy test course to new structure, fix up tests

* the former does a fallback if metadata['display_name'] isn't set.

(s/sequence/sequential/)

* if there is a policy.json in the course dir, read it
* file format is a dict with keys {category}/{url_name}, and values metadata dictionaries
* apply the policy, overwriting keys that are in the xml
* then do metadata inheritance, inheriting any overwritten keys.

* also a management cmd to generate a policy.json from a course dir.

LMS internal auth refactor and start dates

Xqueue callback acquires lock on StudentModule to avoid race condition

- now handling access control via get_module

* error modules now hidden via access control
* get_module() returns None if user doesn't have access

* All access control logic is now in access.py
* It exports a single method for general use: has_access(user, object, action)
 - possible actions depend on object type (e.g. 'see_exists', 'enroll', 'staff')
* Removed DARK_LAUNCH feature flag--it is now the default behavior
* Replaced check_course with three separate more focused functions that use has_access

Minor things:
* note on using pdb in testing
* moved time parsing helper into timeparse.py
* x_modules now have a .start attribute (None if not in metadata)

started gradebook design; moved a few nav classes

Feature/cale/queue config

Fix askbot URLs in the theme

Kimth/generic coderesponse

when MITX_FEATURES['DISABLE_LOGIN_BUTTON'] then show_signup_immediately ...