Add single-user authentication. Closes #11.

Adds a single-user password-only authentication mechanism
behind which all web client views are protected. The app
password, as well as the app's secret key, can be managed from
dagobahd.yml.

This also includes a site-wide rate limit on bad auth requests
of 30 bad requests per minute. This should be invisible to users
under normal usage but still prevent any sort of brute force on
the app password.
Fix hardcoded password value in API tests
Add details to changelog for 0.1.2
Merge branch 'single_auth'

Conflicts:
	CHANGELOG.md