Merge pull request #1 from lloydwatkin/master

Fix for extraction of JID from DISCO request
Fix wrong use of "this" in last merged branch
Use correct namespace for <affiliations/> IQs

I thought the fact that the …/subscriptions endpoints don't work
is due to an outdated buddyloud-server version, but it was in fact
a problem in the HTTP API code. That the unit tests expected the
wrong namespace too ("pubsub" instead of "pubsub#owner") didn't
help…
Don't mention listening remote servers in …/subscriptions replies
Reorganized directory structure (lib/ => src/)

Also, I moved the source files that implement the concrete
API endpoints directly into src/, while helper module now live
in src/util/.
Use pubsub namespace for <affiliations/>, not pubsub#owner (Part 2)

I overlooked this instance before.
Added channelServerDiscoverer middleware and moved discovery code

The complete channel server discovery logic now is in src/util/disco.js.
The new middleware in src/util/api.js automatically discovers the server
for the channel mentioned in the request URI, which makes the resource
handler implementations slightly simpler.
Use "api" instead of "autil" as import name for src/util/api.js
Fix a comment typo
Allow retrieval of node feeds & items in JSON format

The server responds with JSON if the "Accept" header is set to
"application/json". Atom is still the preferred format and is
used as long as "Accept: application/json" is not explicitly
specified.
Let POST /channels/name@domain accept JSON-formatted entries

The format is the same as the one that the node feed and item
endpoints can return now. The format will be documented on the
wiki very soon.
Minor README tweaks
Fix wrong Markdown syntax
Include "replyTo" attribute in JSON node entries
Get <node>/subscriptions right, finally
Allow credentialed cross-domain requests

The specs say that Access-Origin-Allow-Credentials must be "true"
and Access-Origin-Allow-Origin may not be "*" (but the actual
requester's origin).
Allow non-authenticated "null" origin requests
Allow "Authorization" header in cross-domain requests
Always return "401 Unauthorized" if an anonymous request is denied

Previously, the HTTP API would return either 401 or 403
depending on which exact XMPP error was received, but
a 403 response on an unauthenticated request doesn't make
much sense.
Respond to requests for the API root with "204 No Content"

The idea is that clients can use the root URI to e.g. verify
user credentials before doing any "real" requests.