Added specs, proper 401s on missing user, etc.

* Slightly refactored the application with a boot.rb, application.rb and environment.rb so that this can be easily tested. This includes moving `use Rack::Session::Cookie` into the API, the specs will just initialize a `GWAR::API` instance.
* Moved `User` into its own file and added a simple table for id to username. Currently the authentication just checks the username, it should check the password.
* Replaced all `warden.authenticate!` with the non-bang version so that we can raise proper errors. There're other ways to do this via a failure app or, probably better, by moving some of this logic into a helper.
* Added specs for authenticated and non-authenticated scenarios.