Add 404 page
Parse cookies in general, and auth cookies in particular
Add auth helpers, and require authentication for all api endpoints
Tidy up after debugging
Giving up on angluar-cookies, switching to jquery-cookie.

angular-cookies doesn't let you specify the path or attributes of the
cookies.

Cookies were being stored under the /list path, and therefore not being
included in requests to /api paths. This meant using CORS to get auth
working, which was also a horrible pain. jquery's cookie library has
more or less the same API, but is just more flexible.
Add jquery-cookie
Don't show list and tab partials if not logged in