Add authorization middleware; add product columns; clean up migrations

Clean up code

Users must now set up their external webhooks with a 'token' param
containing their product's authentication token. We've designed this
authentication schema with Assembly in mind, but any backend can be
subbed in (we're happy to take pull requests to make auth more
flexible).

Notes: Compojure middleware is a bit wonky (it was getting applied to
routes that it seemed like it didn't belong to), and the VCR-like
library that we're using doesn't really seem to work.

TODO: Investigate the issues with the VCR library; it's lame that that
test has broken.