Move configuration to a settings file and whitelist project directories.

Orders can no longer provide a custom path to a procfile, but instead
must specify a project ID that is defined in the local settings for the
shove instance. This helps avoid being able to upload a file to a site
and then sending a command to shove that points to that user-uploaded
file instead of the expected file in the repo.

Also adds some more comments and refactors a bit of code to be cleaner
and more tolerant of errors.