Jwang limit resource access

Check the authentication header of an HTTP request to see if it's from an admin with the correct password. Limit the "shutdown" REST API to be accessed by admin only. 
can you move `"user"` and `"admin"` to `public static const String`s in `Authorizer`? Magic strings are bad, and we repeat `"admin"` about 7 different places in these files.