Private data repositories

There is 1 failing test, though I don't see how it's related to the work I did, maybe you can help clear that up? Here's the test:

```
    it('should get content from external url', function(done){
      request.get(rurl('/test-pkg/0.0.0/code/externalurl'), function(err, resp, body){
        body = JSON.parse(body);
        request.get(body.targetProduct.downloadUrl, function(err, resp, body){
          assert.equal(body, fs.readFileSync(path.join(root, 'fixture', 'script.r'), {encoding: 'utf8'}));
          done();
        });
      });
    });
```