hapi 8. Closes #12

Ergonomically the special `Boom.unauthorized(null, 'Hawk')` is a bit awkward (I had to read the doc to understand what it meant), but it gets the job done