add config module for yaml config (for OAuth keys etc in future)

also:
* remove backbone from package.json - only used on client side
* update npm-shrinkwrap with package.json changes