Refactor authentication in the PZH Web Interface

This PR goes hand-in-hand with another on the PZH Web Server.  Both or neither must be accepted.

In particular, this pull request does the following:

(1) Introduces a 'sign up' step on the PZH between authenticating and adding a new PZH.
(2) Removes the custom OpenID login/logout step on certificate exchange
(3) Refactors the use of passportjs, to enable us to offer more identity providers
(4) Refactors the routes, slightly, to pull out authentication

http://jira.webinos.org/browse/WP-955

Jira issue: WP-955