introduce express.Router( ), small renaming

Rename a few things here and there to help clarify the situation.

This change introduces use of express.Router( ), which provides the routing
functions of express without the full app.
This also shows an experiment observing the interaction betwen express( ) and
express.Router( ).
There are a few reasons for doing this:

Using express.Router( ) allows introspecting existing routes.
As a REST application, our content payloads should include URLs, links to other
resources available from our API.  As a bonus feature, it's often nice for a
meta page to describe the links, status, and version available from this
particular API.  By far, the easiest way to implement this is to introspect the
existing routes.

Separating the code makes testing easier.
This lays the ground work for breaking apart the code into smaller, more
testable modules.
quick renaming for clarification

This avoids re-using the same variable name in different contexts.
prepping for another re-org

Small hack in order to start separating things out a bit more.
make some breathing room for separate entries
move entries api to separate module

Make as few adjustments as needed to get entries api into it's own module.
quick clean up
preparing to seperate settings and experiments
remove dead code
move experiments and settings to own modules

Also remove notion of common configured middleware.
remove bit of dead code
move all rest components to separate modules
remove api.js in favor of api/ module
let test run
cleanup, use strict everywhere
Update package.json
add some tests for the API
Merge branch 'wip/api-modules' of github.com:nightscout/cgm-remote-monitor into bewest/api/create-entries
require API_SECRET to be at least 12 characters

This changes causes the server to crash if the API_SECRET environment
variable has a value whose length is less than MIN_PASSPHRASE_LENGTH
characters.
The default MIN_PASSPHRASE_LENGTH is 12, so if the API_SECRET variable
is set but less than 12 characters long, the server will crash.

security/privacy review needed
==============================
The API_SECRET is used as a pass phrase in order to generate a unique
token.

The api routes always try to mount themselves.  Before mounting
sensitive routes that allow modifying the application, the secret
token is required to validate the request, or denied.

When the secret token is absent, the sensitive routes should return
404, and should not be mounted.

This change attempts to eliminate some dangerous middle ground between
having a secured api, having a weakly secured api, believing a secure
api is mounted and working when none is, and not having a secure api
mounted.

The only choices available should be:

* secure api mounted
* secure api not mounted

This change hopefully constrains the possibilities to those two
options.
throw err instead of process.exit

Also some minor clean up of log output during tests.
add tests for how API_SECRET affects the process