require admin access for our admin URLs
split off search into the /search URL
store and retrieve whitelist

This will be used to allow select folks to access the app.
untested code to check if user is in the whitelist
make the tree more GOPATH friendly; add some useful notes
add a dummy unit test
port whitelist to use go-json-rest
ignore common URLs
simplify configuration

* just use a single admin/config URL
* read/write struct directly to the DB
* fix a bug parsing the whitelist
extract function writeJson