Client side authentication

### Problem

Currently, the client has no notion of authentication and view control based on the auth status.

### Solution

Created an `authService` to manage the API calls for authentication. A successful login creates a global user object at the `$rootScope` that currently only maintains an email address. Other controllers or services can subscribe to the login/logout events published as members of `authEvents`. A successful logout invalidates the global user object.

These changes control authentication from the aspect of view control. In practice, one could find the views/templates that are hidden from a user who is logged out, but since the server-side auth control checks every request, the heart of the API is still protected.

### Other changes

* created a nav module to decouple from the index
* delegated the responsibility for a `container` div to the templates loaded into the ngView

### Notes

This work brought up some other issues with the UI (i.e. the need for an `alertService`), so new cards will be created for that work.