the new migration management in c8856f10 left out the part where we actually keep the system's current MIGRATIONID... it was being lost when setup/start.sh was re-run

whats_next: Allow the PRIMARY_HOSTNAME to not have an MX because the default value means the domain itself, which is what we want anyway

clarify that an SSL cert can remain self-signed on the non-primary domains if the domain isn't being used for web

migrate the SSL certificates path for non-primary certs to a new layout using a new migration script

move the SSH password login check into whats_next.py (it used to be in start.sh and then moved to an unused script when it became a problem for Vagrant)

Moved the configuration to a single YAML file, rather than one per domain, to be clearer.

re-does 33f06f29

if we handle mail for both a domain and any subdomain, only create a zone for the domain and put the subdomain's DNS records in the main domain's zone file

first pass at a management tool for checking what the user must do to finish his configuration: set NS records, DS records, sign his certificates, etc.

dont ask for a CSR country code on second runs because the CSR is already generated and any new country code won't be used anyway

Add authentication to mailinabox-daemon; resolves #67

Conflicts:
	management/daemon.py

Tell Flask to log to syslog

The updated instruction is not very user-friendly. I think the right
solution is to wrap the `/dns` commands in a `tools/dns.py` style
script, along the lines of `tools/mail.py`.

Intended to be the simplest auth possible: every time the service
starts, a random key is written to `/var/lib/mailinabox/api.key`. In
order to authenticate to the service, the client must pass the contents
of `api.key` in an HTTP basic auth header. In this way, users who do not
have read access to that file are not able to communicate with the
service.

- Writes Flask warnings and errors to `/var/log/syslog`
- Helps to debug issues when running in production