mv API calls into api/ URL namespace
switch the root handler to use a template; add a logout link
add back missing address operator
replace server-side search with one based on AngularJS
verify the whitelist inside the auth middleware
decode json-friendly key names
return the correct javascript mime type
extract function isAuthorized()
move untapped API secrets back to the server

Instead of passing the client id and secret to the client, use app
engine as a proxy to untappd but overlay the id and secret.