Hidden fields

Currently it only works for the `/:collection/:id` route, I've added two extra pieces of middleware, one is the `authCheck` which is a very simple API key checker, the other is `hiddenFields`, this looks for hidden fields based on the request, and exposes them as `req.fields`, this can then be used in the routes when querying the storage and mongo will restrict the returned fields appropriately.

I've also pulled the storage selector logic into a separate module in an attempt to keep the app.js module a bit simpler.

Misc todo items outstanding

- [x] Add tests for more scenarios
- [x] Allow hiding fields on specific docs, rather than the whole collection
- [x] Make this work for all routes
- [x] Update API docs/readme about hiding fields
- [x] API for defining hidden fields.

Closes https://github.com/mysociety/popit/issues/256