Auth refactor

I did a refactor of auth, moving the rendering and auth-checking into our angular app. Things should be working.  I did a few manual tests and all the current tests are passing.

#### Reasoning for the refactor

* Partially motivated by getting totally stuck trying to get protractor tests running
  because of needing to simulate a login that has no front-end component.  I.e. this
  should make front-end testing easier.
* I think it simplifies our code structure by making things consistent - our
  backend is basically an api, and all the rendering and user interaction is
  done in angular
* Urls that the user sees will be consistent (all angular-style urls instead
  of a mix)
* We don't need the `/app` prefix for angular urls
* We can easily display error messages when attempting to login or register
  without reloading the page (angular makes the call asynchronously and
  automatically updates with an error message when it gets a response)
* Static assets (css, images, subtemplates) no longer require auth to access,
  so we can share them among public and user-only pages.

### Setup - backend

* Our express server only serves static files.
* The auth setup is modified slightly:
    * backend login and register routes now send a response with a status and a
      message (which is then parsed by our angular app), rather than doing a redirect
    * The message is obtained from the passport strategy.  When returning
      `done(err, user)` you can include a third argument: `{message: ''}`
      which we can use to pass an error message on for the user to see.

### Setup - angular

* Auth module has login and register controllers, which:
  * Render the forms
  * On submit, use `$http` to post to the backend auth url
  * When the response is received, they display an error message on the page if
    applicable, or redirect to `#dashboard` (placeholder page) if successful
* Logout controller sends `$http` to backend to log out, sets `$rootScope.currentUser` to null and
  redirects to public index page
* Auth module adds an interceptor to `$httpProvider.interceptors` which does two things:
  * When making a request, checks whether we logged in already and whether it's a public page.
    If needed, redirects to login page
  * When a response is received from server, checks for 401 status and redirects to login

### To do
* Write tests yet for the front-end auth module
* Get some protractor tests running
* I haven't read over the code super-thoroughly so it may be a bit messy in places, I had to do
  a lot of experimenting to get things working.  Feel free to comment if something looks off.