Feature/ngui auth header

follow-up to #562 re #554

 * renames MYAPI_PREFIX to myApiPrefix, because although we use it as a constant, it is a factory and hence not injectable in config blocks.

 * delays app bootstrap until we fetch /config.json, which contains runtime config + gives us the authorization header to use on API calls.

@wolf31o2 I believe this implements what we discussed today over hipchat regarding sharing the reverse-proxy auth with CORS port.
will name the currently anonymous function `myApiPrefixFactory` in another PR.