Begin massive cleanup.

Continue to run app.js (not index.js) at this early stage of cleanup.
Moved authentication piece to outside the web server, so it is only run when the app starts.