Added better auth checking

Allows the showoff.json config file to mark paths as protected, so you
can disallow access to "presenter" and "onepage", for example.

If a path is protected, this will check showoff.json for user/password
and attempt basic auth. If user/password are not set, then access is
allowed to localhost or 127.0.0.1 only. If user is not set, then showoff
will use the empty string, so presenters can simply enter a password.