Failing test for hidden fields behaviour

This is a rough cut of how I imagine the hidden fields working when
hiding a field for a whole collection. Currently it involves manually
inserting a record into mongo, but I imagine there will be an API
endpoint for admins to toggle collection-wide visibility.
Tidy up require statements

Require external libraries first, then internal libraries.
Refactor the storage selector into a module

A big chunk of the logic in app.js was the storage selectors. This
commit moves that logic into a separate file and changes it so the
selector is exposed as a simple piece of middleware which the main app
doesn't have to care about other than passing it the options.
Test for authenticated requests viewing hidden fields

Failing test demonstrating using an API key to access the API and
checking that the full object is exposed.
Add an auth check module

Checks incoming requests for an `apiKey` parameter, if present and
correct then `req.isAdmin` is set to true.
Implement hidden fields on /:collection/:id route

This is a WIP, but it demonstrates the mechanics of how the hidden
fields are going to work. The `hiddenFields` middleware exposes a
`req.fields` property which can be passed into the storage class's
`retrieve` method. Mongo uses this field spec to decide what fields to
return.
Refactor collection param validation

Return early with `next` if the collection is valid, then continue to
handle the 404 error.
Move middleware into its own directory

Make it clear what is being required and how it's expected to be used.
Extract validate body middleware into separate module

This isn't specific to the app module, yet a lot of the requires in the
app module were to support this. Moving it into its own module makes it
clearer what it does and what it depends on.
Sort out app.js require statements

Remove the need to re-indent/edit/change other lines when changing
require statements. This seems to be fairly standard in the node/js
community.
Add an email address to the other person fixture

This is for testing hidden fields functionality.
Add a test for hiding fields on a single document

Demonstrates the behaviour when an individual document has been flagged
for having a subset of its fields hidden. This test is currently
failing, which is expected because the feature hasn't been implemented
yet.
Handle hidden fields on individual documents

This handles hiding fields on individual documents as opposed to doing
it collection-wide. Currently it only works for `/:collection/:id`
routes, I foresee a potential issue with the `/:collection` urls because
there will be multiple individual documents in the response, so we may
have to restructure `req.fields` to make the representation clearer, but
that can be tackled next.
Change travis config so messages appear in IRC
Refactor hidden doc middleware

Makes it slightly clearer what's going on with the two separate queries
we do to get the hidden docs for a collection.
Fix typo
Implement collection-wide hidden fields for /:collection

Uses the `hiddenFields` middleware to populate `req.fields`, which then
gets passed to the storage `list` method to inform mongo which fields to
remove from the response.
Move hidden field tests into their own file

These tests are starting to grow quite large, so it seems like they
deserve their own file to make it clear that this is a discrete feature.
Share hidden fields for authenticated user tests

This behaviour is the same for both collection-wide and per-document
requests, so pulling it out into a shared function reduces duplication.
Remove underscore dependency in app.js

I think it's clearer to just use vanilla javascript in this case, since
we're only defaulting one value.