Hidden fields

:warning: WIP: Not ready to merge :warning: 

Here's the current work in progress on the hidden fields feature. Opening this Pull Request so I remember where I got to when I come back to this next week.

Currently it only works for the `/:collection/:id` route, I've added two extra pieces of middleware, one is the `authCheck` which is a very simple API key checker, the other is `hiddenFields`, this looks for hidden fields based on the request, and exposes them as `req.fields`, this can then be used in the routes when querying the storage and mongo will restrict the returned fields appropriately.

I've also pulled the storage selector logic into a separate module in an attempt to keep the app.js module a bit simpler.

Misc todo items outstanding

- [ ] Add tests for more scenarios
- [ ] API for defining hidden fields (or possibly just a cmd line tool/script?)
- [ ] Allow hiding fields on specific docs, rather than the whole collection
- [ ] Make this work for all routes
- [ ] Update API docs about hiding fields