Add basic (trivial) passport authentication

Users should obtain an auth token from /api/login/mabel for internal
accounts, or /api/login/raven for raven accounts. The token is then
handed to protected pages using querystring access_token=xxx.

Developers can protect a page by adding
    passport.authenticate('bearer', {session: false})
as middleware to a route.
Merge branch 'master' of github.com:Hephistocles/mabel

Conflicts:
	app.js
Merge branch 'master' of github.com:Hephistocles/mabel