Fix res.locals stomping

This fixes a bug that causes res.locals to be overwritten when loggedInUser and loginScriptUrl are set.  The test app also had to be modified to manually build the JSON response for the /locals route, since res.locals is a Function.  There may be a more graceful way to do that part of things that I'm not familiar with.