Changed app.js to server.js to keep from confusing the two.
Re-factored access-level and auth to not rely on $rootScope
Added simple username directive.