note Go >=1.1 requirement
add a slim CONTRIBUTING.md
update secureheader to fix redirect
require DATABASE_URL from hkdist web
Change `hk list` to `hk apps` in dev instructions

- `hk list` is no longer an available command; `hk apps` is the same
use jsonsha struct

Avoid the duplication of multiple identical anonymous structs just for
encoding/decoding the sha256.
standardize hkdist paths, struct usage