config.js: slightly more sane formatting
Add support for protecting the site with HTTP Basic

This commit adds a couple of config variables (namely AUTH_ON,
AUTH_USER, and AUTH_PASSHASH) which can be used to configure HTTP Basic
Auth in front of the application.

In addition, we convert all existing crypto to use proper password hash
functions.
Read-only mode: rename config var

As a lead-up to making more of the Index/Census setup configurable, move
the readonly config into the appconfig section.