Handle post_login_redirect_to in login app

This means the login app will redirect back to where the user was after
they have successfully logged in.
Remove invalid code and comment

Now we're using passport for http basic auth we don't need this function
and the comment below is also no longer relevant.
Fix bug with the auth middleware

This was calling 'next' before the getPermissions callback had
completed, so wasn't working in a consistent way.
Return from getPermissions call is there's an error

Without this the function will carry on executing even after an error
has been passed to the callback.
Add requirePermission middleware for authorization

This middleware checks if the authenticated user has permission to
perform a given action.

I've also updated any places that were using requireUser to use the new
middleware. The requireUser middleware has also been kept but that only
checks for an authenticated user, it doesn't tell you whether they've
got permission to edit an instance.
Require the user to be logged in before creating an instance
Add grantPermission method to Permission model

This reduces repetition when granting a user access to an instance.
Simplify new instance creation process

Previously the user had to enter a slug and email address, then they'd
receive an email with a confirmation link, which would lead to a page
with another button that they needed to click before their instance was
finally created. This has now been replaced with a form with a slug
field, which once completed takes the user directly to their new
instance.
Add example cookie_domain config to production.js
stubbed out static html for invited page
stubbed out basic static html for user admin page
hey, that wasn't the right comment style
styling up admin page, added basic layout
Styling and layout of admin page
style and layout of invited page
Add bootstrap javascript
Convert bootstrap to use AMD

This makes it work properly with requirejs.
added more styling to illustrate various states, add JS example modal
tweak padding of invite panel on mobile
Use email instead of username for account logins

The code gets confusing pretty quickly when you call .username on an
object and actually get back an email address. Since
passport-local-mongoose allows the value to be configured, it makes
sense to take advantage of that.