Refactor: Remove dup code around protected API

Most of the protected API calls just throw the raw view
result to the client, and there was a lot of copy-paste
code to remove.
Refactor: Put database access into own file

Move the ~600 lines of database accesss stuff
into /data/lib/database.js
Refactor: Put emailer into own file

Move all the stuff related to sending emails
into /data/lib/emailer.js
Refactor: Common code when emailing guests

We were using copy-paste code for the admins
emailing guests stuff. The result is slightly
dubious, but moves in the right direction.
Refactor: Move authentication into own file

Move most of the authentication stuff into auth.js
Refactor: Minor data/server.js readability

Move a few things around so the flow is a little
better in data/server.js