* Removed Stormpath security (it added way too much overhead)
* Added custom security using the existing Backer model
- Same as before, all requests to the API must be authenticated using an 'Authorization' header
- Email is the backers ID, username is their display name (and should also be unique)
- You can log in with any email you like, the account will be created if it doesn't already exist
- All passwords are 'password'