Removed jwtSecret from issuer model.

We'll just have an environment variable define a single
universal secret instead, rather than having a separate secret per
issuer.
Use OPENBADGER_JWT_SECRET for API calls.
added conmock from mozilla/openbadges.
Added some tests for routes/api.js's auth() middleware.