Add security

Add passport security, using bcrypt password encoding and the passport
local strategy.  Also add UI support via the new session API.
Authenticated model/collection will redirect to the login route when
authentication fails.