move auth to an express middleware so we catch all

Signed-off-by: Niv Sardi <xaiki@evilgiggle.com>
auth: return JSONified object on authenticate()

Signed-off-by: Niv Sardi <xaiki@evilgiggle.com>
cut out cruft in login.jade

Signed-off-by: Niv Sardi <xaiki@evilgiggle.com>