HTTP+ logging now shows time taken by each request

* When a response status is logged (via the HTTP+ log flag) it now
  includes the time taken by the handler in milliseconds.
* Request/response logs now start with a unique serial number for each
  handler, so you can match the request with the response.
Added admin REST API to perform CPU profiling

A POST to /_profile on the admin port turns CPU profiling on/off.
To turn on profiling, add a JSON "file" property whose value is the file
path to write the profile to.
To turn off profiling, omit the "file" property.

The profile file can be analyzed using the Go 'pprof' tool -- see
http://blog.golang.org/profiling-go-programs
Fixed auth bug where user with access to * is denied docs w/no channels

Dumb logic error in AuthorizeAnyChannel method, when the argument is an
empty list but the user has access to *...