run apps inside minimal docker image for process & network isolation

add proxy server to proxy <appId.userId.*> to the docker-assigned port on the appropriate slave
fix load reporting, and use actual sjs/conductance path instead of assuming ~/dev/oni
authentication
got auth working
centralized env settings, slaves now authenticate with master on new connection, so they dont need to access the user DB
added account signup