No longer de-escalate the PhantomJS user.

  * update the README to reflect better practice for running node.js apps
  * extract out the phantomjs binary path to a config (so users can override)