Add auth api to the server, use cookies

Add POST /auth and GET /permissions for
authenticating with the server and going
from there. Uses sealed cookies.

Always allows access for the time being;
changing soon.
Add authentication to the client

Authorize with the server by posting to /auth.
Check /permissions to see what we can do.

UX:

Hide authcode box and move the focus to the
editor when a correct authcode is entered.

Prevent the menu (which includes the authcode box)
from hiding if we're entering in an authcode.

Only show authcode box when we don't have
write permission.
Refactor: Rename 'deploy' to 'config'

The data in the deploy folder is really
config stuff that is used during server
startup, so 'config' is the primary thing.
Add settings file

along with an overrides file for development.
Auth: Keep a record of active sessions

Set cookies to expire after six months, and
be renewed on a rolling basis.
UX: Focus on the auth box when not signed in

The auth box demands attention if we don't have
permission to write. Since notes is for personal
notes, it's a big deal if writing can't happen,
so we reflect that notion.
Readme: Add security section

We added an authentication thing, so write a
little bit about it.