Add authUser to req when performing an API auth

This will make (possibly) make it simpler to use the authenticated API
endpoints since the auth token should have the user email embedded in
it. Endpoints that take advantage of `req.authUser` should no longer
have to ask for the user email address.
Self-document options for various badge fields.

Before now we could get away with those fields being loosely defined
since they weren't used internally, however the badge recommendation
engine is going to expect certain values for some of those fields. In
order to make the model more self-documenting, I've added enum
validators to some of the fields where we expect certain data to have a
specific form.
Start adding more fixtures for testing.
Add comment.
Starting the recommendation system.

Right now we are doing the following:

* Filter earned badges
* Filter category-level badges
* Filter offline badges

We store this collection as `allBadges`, then

* Filter participation badges
* Filter badges that belong to categories where the user has already
  earned the category-level badge
* Filter badges that are "off-track", meaning, badges in categories
  where the user hasn't completed any other badges.

And we store this collection as `filtered`. If `filtered` is an empty
set, we shuffle `allBadges` and recommend that set.

There are a number of ways this can be improved which I have marked in a
TODO in models/badge.js
Use `Badge.getRecommendations` in the api.
Remove unused constant.