Add passport for authentication

Include passport as a design pattern for handling authentication,
currently just username (ignoring any passwords).  This uses express’
session cookie, which lives for 30 days.  All requests to /api/*
require authentication, and the /session APIs do not (which
login/logout the user).  Update dependencies to latest.