[bug 972919] Cleaned up app.js

A simple refactor. See the diff for details
[bug 972919] Removed CORS logic

In the previous Login strategy, other app's views would query the Login
server directly. This required the Login server to use custom middleware to
check CORS headers sent along with each request. Since each server now
communicates with Login on behalf of their views (using webmaker-auth &
webmaker-auth-client) the CORS logic is no longer needed.
[bug 972919] Removed outdated information from the readme

The change of strategy with the login server invalidated most of
the integration steps that were listed in the README. It still
needs an update (https://bugzilla.mozilla.org/show_bug.cgi?id=939845)
but that is outside the scope of this bug.
1.0.37