Add endpoints for adding, revoking badges.

* Add an endpoint for directly awarding badges
* Add an endpoint for directly revoking badges
* Update mongoose from 3.2.1 to 3.6.7
* Fix `api.auth`: flip conditional so parameters are only sought in `req.query` if method is GET. Out of the common HTTP methods, POST, PATCH, PUT and DELETE all end up sticking the parameters in `req.body`, and GET is the only one that pulls params from the query string, so we should default to using `req.body` unless the method is GET.