Refined server middleware stack (auth, static)

1. We now use a modified static middleware function to hide the
index.html file but serve other 'static' files without checking with
the auth layer;
2. Added authorization layer right after auth (gatekeeper) layer;
3. Fixed the issue with passport.session() middleware, we don't
deserialize the user anymore, but still we use just the username string
in req.session to support req.isAuthenticated();