OmniAuth authentication

I haven't squashed the commits, but this branch uses OmniAuth to require login via Google for instructors/admins to modify content.  See README_FOR_APP.md for details.
I haven't merged to master yet but I have rebased and all tests are passing.  Since I am not the experiment owner, someone other than me should decide when to merge to master and deploy.
Notable things that affect development:
- SSL is now turned on for the app (since credentials are being passed around), *but* it is not forced for the API calls about user consent or getting waiting room group-formation times.
- A Google OAuth client key and client secret must be part of the environment variables in order for auth to work. I set this up already for moocchat.herokuapp.com, but if you want the app to also work in your "personal" production environment on heroku, you'll have to setup your own client key & secret; again, see `README_FOR_APP.md`
- In development, SSL is turned off, and authentication is not via Google but simply by typing your email address (for most of you, either your berkeley or gmail address should work; see the most recent migration for a list of all the google IDs).  Regardless which authentication mode is used, in order to be an Admin or Instructor you have to have the right kind of Users table record and it must contain an email address matching your Gmail or Bmail one.  (The latest migration adds all these to the production database and your development database.)

This is ready to be merged and deployed but I didn't want to step on anyone else's testing or dev.  NOTE that when it's deployed you have to `heroku run rake db:migrate` to get the latest migration in place.

(Alternatively, if this seems too much of a risk and the experiment ends up starting tomorrow as we hope it will, we could delay this merge if we trust the MOOC students not to try to screw things up.)