use lefnire/racer so we can test accessControl functions originating
from client or server
fix REST testing setup
don't log in user with REST call
Merge branch 'master' of github.com:lefnire/habitrpg