add minimal user authentication infrastructure

* simple auth layer with pluggable back-ends (similar to persistence)
* dummy pass-through auth back-end for dev/tests
add npm package "token"
add simple HMAC based authentication back-end
more robust login request handling

fail early in case of some typical error scenarios
allow omitting ABE config block

(no config required for passthrough ABE module)
Merge pull request #8 from yelworc/auth