Support for multiple protected URLs

Protected URLs are now specified in config.json using an array.
Inbound URLs are matched against each protected URL until a match is found.
Adjusted the sample target app to handle multiple protected folders.
A default next callback is passed into calls to protected() in each test. This prevents unecessary and confusing errors when the code attempts to invoke the undefined callback function.
The cli now treats the protected URL as an array