db: add users.password_hash
server/auth: very basic login, using token

Using JSON Web Token.
It should be be pretty straightforward to add G+/Facebook OAuth.
client/login: very basic auth

- add /login page
- store token in localStorage
- on bootstrap, redirect to login if no token present
- intercept all XHRs, add the token
chore: add a script for running db-migrate
server/api: secure all apis and provide AuthenticatedUser

- set current user’s id when creating reservation
- provide AuthenticatedUser, AuthenticatedUserId
style/server: rename di-express -> di_express

Just to follow the convention of the project.
style/server: rename send_mail_test
client/login: show instructions how to login
server: err.statusCode -> err.status

That’s what express-jwt uses.
client/login: handle login errors

- invalid password
- not allowed email
server/auth: normalize errors

- status
- code
- message
client/auth: handle 401 errors

Show /login form and repeat requests after successful authentication.

Re-apply route change if the 401 error happened during resolving
route’s dependencies (`resolve`).