add basic permissions system

add a permissions collection to master db and use this to determine if a
logged in user can edit an instance.
on request setup add a permissions object to the req and locals which
only contains a can_edit_instance property at the moment but cuold be
expanded in future
Also update the templates to use this
store the permissions in an object in the collection

That way we can have multiple permissions for each user/instance
relationship
POC version of admin accounts list page
Move legacy auth app back into instance app

Because the hosting app uses the masterSelector, it's 'req.popit' object
is only connected to the _master database. This means that when the User
model is accessed in the auth app it actually looks in the _master
database's users collection, which doesn't exist.

By moving this app into the instance app we can have this handle both
legacy and new-style logins, then have a separate login app for the
hosting app which just handles new-style logins.
Add separate login for hosting app

This only handles new style logins, since on from the hosting app
there's no way to know which instance the user is trying to log into
using their legacy credentials.
Use passport-http for API authentication

This allows both legacy and new accounts to authenticate over the API.
Prompt user to upgrade their legacy account

When a legacy account is detected take the user to an upgrade page which
allows them to associate their legacy instance with a new-style account.
Fix auth tests

Make sure the login route redirects upon success and the logout route
exists.
Simplify auth tests

supertest provides a variety of ways to assert the headers and body of
the response are correct, so use those rather than doing comparisons in
the 'end' callback.
Upgrade user's account after successful login or registration

When a user successfully logs in or registers after being prompted to
create an account create a new permission document which links their
account to the instance being upgraded. This uses the
legacyAccountUpgrade middleware, which looks for a legacyInstanceId in
the session and if found uses it to create appropriate permissions.
Tell the user when their account is being upgraded

Add a message to the login and registration forms when the user is
upgrading their account telling them what's going on and then when the
upgrade is complete show a flash message telling them they have been
upgraded.
Link to the hosting app registration page

The instance app doesn't have a registration page, so we link to the
hosting app's registration from the legacy account upgrade page.