remove app.coffee; simplify entry point
change the way we inject testing secret
don't store anything in the browser
access identity via controller
vendorize scrypt

https://github.com/tonyg/js-scrypt
generate key based on email + password
'secret' is actually the secret key
generate random key on server startup
challenge based on nonce