Pluggable authentication: allow_all, or use a cookie to check user record in DB

@hustonhoburg added authentication and lightweight authorization. It's low-fuss enough that you might consider it for mainline.

* authentication.authenticator(name) gives you the requested authenticator
  - server.js uses options['authenticator']
  - 'allow_all' is default in bin/collector-config.js etc.

* authenticator.check(request, auth_ok, auth_no)
  - calls auth_ok if authenticated, auth_no if rejected
  - staples an 'authorized' member to the request object:
    - eg we use 'request.authorized.admin' to govern board editing
    - in the mongo_cookie authenticator, it's the user record

* mongo_cookie authenticator compares bcrypted cookie to a stored hashed secret

You must set the cookie and store that db record in your host client; see 'test/authenticator-test.js' for format. Rails+devise snippet available on request.

_Note: the second patch lays in the auth stuff, so it may be helpful to look at it on its own. The first commit of this pull request lays in basic metalogging stuff from #91. I took some care to make it a reduced set of shared changes; this and #91 will merge cleanly._