Simplify deployment configuration for mws and ivs.

- Each webapp is now served off of the same "virtualhost", but we
use a URL prefix to distinguish things.
- Update README for completeness.
- Make sharing of cookie secret explicit between ivs and mws in
config.
Add poorauth to grading API call.
Specify egg.
Use public repo.