Badge instances schema.
Whitespace
Move webhooks into own schema/model, add webhook secret.

We want to be able to sign our webhook requests so the other end can
verify the request is coming from a trusted source. Our plan is to
generate a unique shared secret for each registered webhook. This secret
will be used *only* for signing outgoing webhook requests.
Can create badge instances and get the assertions.
Rearrange sql clauses.
Fix test data.
Can create a valid badge assertion.
Fix broken program test
Make images public
Exempt /public/* urls from auth
Test for criteria.
Call system webhook when a badge is awarded.
Remove stubbed out routes.
Factor out `dateFromUnixtime`
Make `hash` lib, put `sha256` and `sha1` in there.
Trailing comma consistency in badge-instances.js
Factor our route suffix for creating new instances
Add TODO about fully qualifying assertion URLs.
Remove `crypto` dependency.
No need to `.concat`!