Break it out

This is a pretty major revision of this app back to its original use: accepting Stripe payments.
The public pass through has been removed, as well as those files. This means that this app has one endpoint: `POST /pay`.

Because it is a single endpoint on a different domain, CORS has also been implemented as Express middleware. This shouldn't go live until we're ready to switch entirely over to the new build system, which puts all the files that used to be in `/public` on a bucket on S3