Let there be auth.

Collections are now only published to available people.    This requires
server-side mongo db editing using Meteor mongo.   Some notes for the
console use:

db["users"].find() returns the list of dudes.
db["restaurants"].find() for the list of restaurants.  Note the ID.
db["users"].update({_id: userId}, ($set: {"profile.admin": true,
"restaurantId": restaurantId}))

And so on.   All of the sub-collections now have a restaurantId
associated with them, and we only publish to the client if the logged in
User's restaurantId matches.